CoreQ Academy My progress
READDEMOGUIDED LABINDEPENDENT LABQUIZREVIEW
Module 4 of 7 · 30 min

Users, groups and permissions

Beginner · 2/5

Written by CoreQ Academy (drafted with AI assistance). Awaiting review by Sean Ofodile.

You will be able to
  • Read rwx permission strings and octal modes
  • Change permissions and ownership
  • Apply least privilege to service files

Reading -rw-r-----

After the type character come three triplets: owner, group, others. Each is read, write, execute. -rw-r----- means the owner can read and write, the group can read, and others get nothing.

Octal modes

r=4, w=2, x=1. Add them per triplet: rw- = 6, r-- = 4, --- = 0, so 640.

$ chmod 640 app.conf
$ chmod u+x deploy.sh
$ chmod go-w shared.txt

Ownership

chown user:group file changes ownership and needs root. Services run as dedicated accounts so a compromise of one service cannot read everything.

Least privilege

Give exactly the access needed. A secrets file that one service needs should be readable by that service's group and nobody else, never 644 just to make an error disappear.

Demo: try these in the terminal

ls -l /etc/webapp/app.confsee current mode and owner
id webappcheck the service account's groups
systemctl status webappread the failure
touch demo.sh && chmod 750 demo.sh && ls -l demo.shpractice octal modes

Quiz

Knowledge quiz · pass mark 80%
  1. A config file must be readable only by the webapp service. Best setting?
  2. A regular user can give their file to another user with chown.
  3. In -rwxr-x---, what can the group do?
  4. As root, set owner root and group webapp on app.conf.
    $
  5. Why can student not cd into /home/alice (mode 700, owner alice)?
  6. What octal mode is rw-r-----?
  7. Add execute permission for the owner of deploy.sh.
    $
  8. Which modes let others (not owner or group) read the file? (choose all)