RHCSA RHCSA File Permissions and ACLs 5 — Questions and Answers
Question 1: Which file stores the default umask for all users logging in via a shell on a RHEL system?
- /etc/profile (Correct answer)
- /etc/umask
- /etc/login.defs
- /etc/bashrc
Correct answer: /etc/profile
/etc/profile sets system-wide environment defaults including umask for login shells.
Question 2: A directory listing shows 'drwxrwt---'. What special bit is set?
- Sticky bit (Correct answer)
- setuid bit
- setgid bit
- ACL bit
Correct answer: Sticky bit
A lowercase 't' in the other-execute position indicates the sticky bit is set and execute is also enabled.
Question 3: User tom wants to allow user sara read and execute access to /opt/app without changing the file's group. What is the best approach?
- setfacl -m u:sara:rx /opt/app (Correct answer)
- chmod o+rx /opt/app
- chgrp sara /opt/app && chmod g+rx /opt/app
- usermod -a -G app sara
Correct answer: setfacl -m u:sara:rx /opt/app
ACLs allow granting per-user permissions without modifying group ownership or broad 'other' permissions.
Question 4: What does 'setfacl -R -m u:bob:rwx /shared' do?
- Recursively adds an ACL granting bob full access to all files under /shared (Correct answer)
- Removes all ACLs from /shared and grants bob standard permissions
- Sets bob as the owner of /shared recursively
- Grants bob ACL access only to the /shared directory itself
Correct answer: Recursively adds an ACL granting bob full access to all files under /shared
The -R flag makes setfacl apply the ACL modification recursively to all files and subdirectories.
Question 5: Which command would verify that an ACL is effectively limiting group 'interns' to read-only despite a broader ACL entry?
- getfacl file and check the effective: comment next to the group entry (Correct answer)
- ls -lZ file
- stat file
- cat /proc/acl/file
Correct answer: getfacl file and check the effective: comment next to the group entry
getfacl displays 'effective:' annotations showing the ACL mask's impact on each entry's actual permissions.
Question 6: A script /usr/local/bin/backup.sh is owned by root with permissions rwsr-xr-x. What security concern does this raise?
- Any user who executes the script will run it as root, creating a privilege escalation risk (Correct answer)
- The script cannot be executed by non-root users
- The script will run with the calling user's group instead of root's group
- The sticky bit prevents users from modifying the script
Correct answer: Any user who executes the script will run it as root, creating a privilege escalation risk
setuid on a root-owned script means all users execute it with root privileges, which is a significant attack surface.
Question 7: Which command backs up all ACLs from the /project directory tree into a file for later restoration?
- getfacl -R /project > acl_backup.txt (Correct answer)
- setfacl --backup /project > acl_backup.txt
- tar --acls -czf acl_backup.txt /project
- cp -a /project acl_backup.txt
Correct answer: getfacl -R /project > acl_backup.txt
getfacl -R outputs all ACL entries recursively in a format that setfacl --restore can later reimport.
RHCSA RHCSA File Permissions and ACLs 5
Which file stores the default umask for all users logging in via a shell on a RHEL system?