When permissions behave unexpectedly, several layered tools help diagnose the cause. To find setuid binaries — both for auditing and for spotting potential privilege-escalation paths — find / -perm -4000 -type f 2>/dev/null lists them across the filesystem, suppressing permission errors. The parallel audit for world-writable files is find / -type f -perm -o+w -not -path '/proc/*' -not -path '/sys/*'. When a single chmod call fails and the error looks opaque, strace -e trace=chmod chmod 755 file shows the kernel syscall and the precise errno, exposing read-only mounts, immutable flags, or LSM denials. In practice chmod itself is rarely blocked from setting a bit on a file you own; the failure almost always lives in a flag or mount option rather than in chmod's logic.
Read-only file behavior can also be confirmed at the mount level: mount | grep ' ro,' or inspecting /proc/mounts reveals which filesystems are mounted read-only. Bind mounts allow a particular directory to be remounted read-only through mount --bind /src /dst followed by mount -o remount,ro /dst, useful for handing a read-only view of data to a service. To make an entire directory tree read-only in user space, chmod -R a-w path strips the write bit from every class on every entry. The /etc/sudoers file expects mode 440 owned by root:root, and edits should always go through visudo so the syntax is validated before saving — a small habit that prevents locking oneself out of root.
Beyond traditional Unix permissions, mandatory access control systems add a second decision point. SELinux contexts can be reset with restorecon -Rv path, which re-applies the labels defined by policy after copying files or restoring backups. AppArmor profiles live in /etc/apparmor.d/ and can be inspected with aa-status. Alongside these policy frameworks, the kernel tracks the difference between the real user ID (RUID, who invoked the program) and the effective user ID (EUID, the identity used for permission checks, often changed by setuid); the running identity is exposed by whoami or id -un, with UID and GID available through id -u and id -g. Together, ACLs, capabilities, and LSM policies extend Linux permissions far beyond the rwx triple into a layered, defense-in-depth model.