Title: Linux File Permissions And Chmod Patterns — LearnCoachAssist

Q: What does rwxr-xr-- mean?
A: Owner: rwx (7).
Group: r-x (5).
Other: r-- (4).
Octal: 754.

Q: Convert 644 to symbolic.
A: rw-r--r-- — owner read+write, group read, others read.

Q: Convert 755 to symbolic.
A: rwxr-xr-x — typical for executables and directories.

Q: Convert 600 to symbolic.
A: rw------- — typical for private files like ~/.ssh/id_ed25519.

Q: Convert 700 to symbolic.
A: rwx------ — typical for ~/.ssh directory.

Q: Why must ~/.ssh be 700?
A: SSH refuses to use a key in a directory or with permissions that are group/world accessible — security check.

Q: What does chmod u+x file do?
A: Adds the execute bit for the file's owner only.

Q: Difference between chmod g+s dir and chmod o+t dir?
A: setgid on directory: new files inherit group of dir.
sticky bit: only owner can delete files in dir (like /tmp).

Q: Setuid bit example?
A: chmod u+s /usr/bin/passwd — runs as file owner (root) regardless of caller. Use with care.

Q: Numeric chmod for setuid+rwx for owner, rx for group/other?
A: 4755.

Q: How to recursively set 755 on dirs and 644 on files?
A: find . -type d -exec chmod 755 {} \; -o -type f -exec chmod 644 {} \;

Q: Change owner and group?
A: chown user:group path; add -R for recursive.

Q: Show numeric permissions of a file?
A: stat -c '%a %U %G %n' file

Q: Default umask of 022 — files created with what perms?
A: 666 & ~022 = 644; dirs: 777 & ~022 = 755.

Q: Set umask 077 — meaning?
A: New files: 600; new dirs: 700 — strict, others get nothing.

Q: ACL command to grant a user read on a file?
A: setfacl -m u:alice:r file

Q: View ACLs?
A: getfacl file

Q: Default ACL on a directory?
A: setfacl -d -m u:alice:rx dir — applied to new files created inside.

Q: How to make a file immutable?
A: chattr +i file — even root can't delete/modify until chattr -i.

Q: View extended attributes?
A: lsattr file

Q: File owned by user 0 means?
A: Owner is root (UID 0).

Q: Difference between effective user ID and real user ID?
A: RUID: who invoked the program.
EUID: identity used for permission checks (changes with setuid).

Q: Why ./script says Permission denied even when readable?
A: Execute bit not set — chmod +x script.

Q: Shorthand to set rwx for owner only?
A: chmod 700 file or chmod u=rwx,g=,o= file

Q: ls output column for permissions starts with d, l, -. What do they mean?
A: d: directory.
l: symlink.
-: regular file.
c/b: char/block device.
s/p: socket/pipe.

Q: How are symlink permissions interpreted?
A: Always 777 on the link; actual checks happen on the target.

Q: Permission for sudo usage in /etc/sudoers?
A: File should be 440 owned by root:root; edit via visudo to validate syntax.

Q: Read-only a directory tree?
A: chmod -R a-w path — removes write for all; or set on parent and rely on umask for new files.

Q: Recursive ownership change?
A: chown -R user:group path — note: changes ownership of symlinks themselves; use -h to operate on symlinks.

Q: Common Apache web-root perms?
A: Directories: 755 with owner the deployer, group www-data. Files: 644. Writable upload dirs: 775 or 770 owned by www-data.

Q: Permission for shell scripts in ~/.local/bin?
A: Typically 755 or 700 if private. They must have execute for the user who runs them.

Q: Permission error 'Operation not permitted' but you own the file — likely cause?
A: Immutable attribute (chattr +i), SELinux/AppArmor, or filesystem mounted read-only.

Q: Read-only mount detection?
A: mount | grep ' ro,' or check /proc/mounts.

Q: Why www-data can read a file owned by claudeuser?
A: Either file is world-readable, or group is www-data and group has read, or ACL grants it, or POSIX.1e ACL/default ACL.

Q: Set group of a directory tree?
A: chgrp -R www-data dir

Q: Lock a sensitive log so it can only be appended?
A: chattr +a logfile — append-only; even root can't truncate without removing the attr.

Q: What blocks chmod from setting a permission?
A: No path is blocked by chmod itself if you own the file; mounted with restrictive options (like nosuid, noexec) restricts effective behavior.

Q: noexec on /tmp — effect?
A: Programs in /tmp can't be executed even if marked +x — defense against malware dropped to /tmp.

Q: Set new files to inherit group via setgid?
A: chmod g+s shared/

Q: Default umask on Ubuntu desktop?
A: 022.

Q: Effect of umask 002?
A: Files become 664 — useful when working in a shared group; group-write enabled.

Q: PASSWD file perms?
A: /etc/passwd: 644 (world-readable, just usernames/UIDs).
/etc/shadow: 640 root:shadow (password hashes).

Q: How to back up POSIX ACLs?
A: getfacl -R / > acls.bak; restore with setfacl --restore=acls.bak.

Q: Filesystem that doesn't support POSIX ACLs?
A: FAT32 — only stores 8.3 attributes; mount options simulate.

Q: Best command to audit world-writable files?
A: find / -type f -perm -o+w -not -path '/proc/*' -not -path '/sys/*'

Q: Find SUID binaries?
A: find / -perm -4000 -type f 2>/dev/null

Q: Why is /etc/passwd world-readable?
A: Many tools need to map UID→username; only password hashes (in /etc/shadow) are private.

Q: Capability instead of full setuid?
A: setcap cap_net_bind_service=+ep /path/binary — grants specific capability without making whole binary setuid root.

Q: View capabilities of a binary?
A: getcap binary

Q: Reset a directory tree to standard perms?
A: find dir -type d -exec chmod 755 {} +; find dir -type f -exec chmod 644 {} +;

Q: Quick way to copy permissions from one file to another?
A: chmod --reference=src dst

Q: Set sticky bit on /tmp numerically?
A: 1777 (rwxrwxrwt).

Q: Why can normal users write to /tmp but only delete their own files?
A: Sticky bit prevents users from deleting/renaming files they don't own — even if the directory itself is world-writable.

Q: chown a file you don't own to yourself?
A: Requires root — for security.

Q: Add multiple ACL entries at once?
A: setfacl -m u:alice:r,u:bob:rw,g:devops:rwx file

Q: Remove all ACLs from a file?
A: setfacl -b file

Q: Test: which user is effective in a script?
A: whoami or id -un; for UID/GID: id -u / id -g.

Q: Bind-mount a directory read-only?
A: mount --bind /src /dst, then mount -o remount,ro /dst.

Q: Newer alternative to ACLs for fine-grained access?
A: POSIX capabilities for binaries; SELinux/AppArmor for system-wide MAC policies.

Q: Tell what's blocking a syscall when chmod fails?
A: strace -e trace=chmod chmod 755 file — shows the syscall result and the underlying error code.

Q: Filesystem ownership beyond chown — set on btrfs / xfs?
A: Same POSIX rules apply; btrfs supports POSIX ACLs and xattrs; XFS supports POSIX ACLs and DMAPI.

Q: Restore SELinux contexts?
A: restorecon -Rv path — re-applies labels defined by policy.

Q: AppArmor profile location?
A: /etc/apparmor.d/; check status with aa-status.

Q: Why can root read but not delete a file owned by another user?
A: Root can do anything filesystem-wise (unless immutable). If delete fails, suspect chattr +i or a mount option (read-only).

Q: Set permissions on a brand-new file at creation in shell?
A: install -m 600 src dst — copy with explicit mode, owner, group in one go.

Q: Quick perms for SSH key files?
A: Private key: 600. Public key: 644. .ssh dir: 700. authorized_keys: 600.