RHCSA File Permissions and ACLs Questions and Answers — Questions and Answers
Question 1: A system administrator needs to set default permissions for all new files created in a specific directory, `/srv/data`, so that new files automatically inherit the group ownership of the directory and can be modified by any member of that group. Which of the following commands would accomplish this for the directory?
- chmod g+s /srv/data (Correct answer)
- setfacl -m d:g::rw /srv/data
- chown :datagroup /srv/data
- chmod o+t /srv/data
Correct answer: chmod g+s /srv/data
The `chmod g+s` command sets the Set Group ID (SGID) bit on the directory. When SGID is set on a directory, any new files or subdirectories created within it will inherit the group ownership of the parent directory, not the primary group of the user who created them. This is essential for collaborative environments where files need to be accessible by a specific team.
Question 2: A user reports they cannot delete a file they own inside the `/tmp` directory, even though the directory permissions appear to be `drwxrwxrwt`. What is the most likely reason for this issue?
- The file has an immutable attribute set with `chattr`.
- The user does not have write permissions on the file itself.
- The Sticky Bit is set on the `/tmp` directory, preventing users from deleting files they do not own. (Correct answer)
- The user's umask is preventing the deletion.
Correct answer: The Sticky Bit is set on the `/tmp` directory, preventing users from deleting files they do not own.
The 't' at the end of the permission string `drwxrwxrwt` indicates that the sticky bit is set. When the sticky bit is set on a directory, it restricts file deletion. Only the file's owner, the directory's owner, or the root user can delete or rename files within that directory, regardless of who has write permissions on the directory itself. This is a common security measure for public directories like `/tmp`.
Question 3: Which command will grant the user `auditor` read-only access to the file `/var/log/secure` without changing the file's owner or primary group permissions?
- chown auditor /var/log/secure
- chmod o+r /var/log/secure
- setfacl -m u:auditor:r-- /var/log/secure (Correct answer)
- usermod -aG root auditor
Correct answer: setfacl -m u:auditor:r-- /var/log/secure
The `setfacl` command is used to set Access Control Lists (ACLs), which provide a more granular permission system than standard Unix permissions. The `-m u:auditor:r--` option modifies the ACL to specifically grant the user 'auditor' read-only (`r--`) permissions on the file, without affecting the base owner, group, or other permissions.
Question 4: A system administrator runs the command `umask 0027`. What will be the default permissions for a newly created directory?
- 770
- 750 (Correct answer)
- 640
- 777
Correct answer: 750
The `umask` value is subtracted from the system's default permissions for new files and directories. For directories, the default is 777 (rwxrwxrwx). Subtracting the umask of 027 results in: 7-0=7, 7-2=5, 7-7=0. Therefore, the resulting permissions will be `750` (`rwxr-x---`).
Question 5: An executable file named `app.sh` has the following permissions: `-rwsr-xr--`. Which of the following statements is true?
- Any user can write to the file.
- The file will run with the privileges of the group owner.
- The file will run with the privileges of the file owner. (Correct answer)
- Only the owner and members of the group can execute the file.
Correct answer: The file will run with the privileges of the file owner.
The 's' in the owner's execute permission slot (`-rws...`) indicates that the Set User ID (SUID) bit is set. When an executable with the SUID bit is run, the process executes with the permissions of the file's owner, not the user who ran it. This is commonly used to allow regular users to run commands that require elevated privileges for specific tasks.
Question 6: After noticing a file has extended ACLs, indicated by a `+` sign in the `ls -l` output, a system administrator wants to completely remove all ACL entries and revert to standard POSIX permissions. Which command should be used?
- setfacl -x /path/to/file
- setfacl -k /path/to/file
- chmod 755 /path/to/file
- setfacl -b /path/to/file (Correct answer)
Correct answer: setfacl -b /path/to/file
The `setfacl` command with the `-b` (or `--remove-all`) option is the correct way to strip all extended ACL entries from a file or directory, leaving only the base permissions for the owner, group, and others. The `+` sign in the `ls -l` output will disappear after this command is successfully executed.
RHCSA File Permissions and ACLs Questions and Answers
A system administrator needs to set default permissions for all new files created in a specific directory, `/srv/data`, so that new files automatically inherit the group ownership of the directory and can be modified by any member of that group.
Which of the following commands would accomplish this for the directory?