Skip to content

Chapter 6 of 6

Diagnostics, Mounts, and Mandatory Access Control

When permissions behave unexpectedly, several layered tools help diagnose the cause. To find setuid binaries — both for auditing and for spotting potential privilege-escalation paths — find / -perm -4000 -type f 2>/dev/null lists them across the filesystem, suppressing permission errors. The parallel audit for world-writable files is find / -type f -perm -o+w -not -path '/proc/*' -not -path '/sys/*'. When a single chmod call fails and the error looks opaque, strace -e trace=chmod chmod 755 file shows the kernel syscall and the precise errno, exposing read-only mounts, immutable flags, or LSM denials. In practice chmod itself is rarely blocked from setting a bit on a file you own; the failure almost always lives in a flag or mount option rather than in chmod's logic.

Read-only file behavior can also be confirmed at the mount level: mount | grep ' ro,' or inspecting /proc/mounts reveals which filesystems are mounted read-only. Bind mounts allow a particular directory to be remounted read-only through mount --bind /src /dst followed by mount -o remount,ro /dst, useful for handing a read-only view of data to a service. To make an entire directory tree read-only in user space, chmod -R a-w path strips the write bit from every class on every entry. The /etc/sudoers file expects mode 440 owned by root:root, and edits should always go through visudo so the syntax is validated before saving — a small habit that prevents locking oneself out of root.

Beyond traditional Unix permissions, mandatory access control systems add a second decision point. SELinux contexts can be reset with restorecon -Rv path, which re-applies the labels defined by policy after copying files or restoring backups. AppArmor profiles live in /etc/apparmor.d/ and can be inspected with aa-status. Alongside these policy frameworks, the kernel tracks the difference between the real user ID (RUID, who invoked the program) and the effective user ID (EUID, the identity used for permission checks, often changed by setuid); the running identity is exposed by whoami or id -un, with UID and GID available through id -u and id -g. Together, ACLs, capabilities, and LSM policies extend Linux permissions far beyond the rwx triple into a layered, defense-in-depth model.

All chapters
  1. 1Reading and Converting Permission Modes
  2. 2Special Permission Bits and chmod Patterns
  3. 3Ownership, chown, and Recursive Patterns
  4. 4SSH, Immutable Files, and Sensitive Data
  5. 5POSIX ACLs, Filesystem Attributes, and Capabilities
  6. 6Diagnostics, Mounts, and Mandatory Access Control

Drill it

Reading is not remembering. These come from the Linux File Permissions And Chmod Patterns deck:

Q

What does <code>rwxr-xr--</code> mean?

Owner: rwx (7).Group: r-x (5).Other: r-- (4).Octal: 754.

Q

Convert <b>644</b> to symbolic.

rw-r--r-- — owner read+write, group read, others read.

Q

Convert <b>755</b> to symbolic.

rwxr-xr-x — typical for executables and directories.

Q

Convert <b>600</b> to symbolic.

rw------- — typical for private files like ~/.ssh/id_ed25519.