Users, groups, permissions, sudo and ACLs

Permission model

Each filesystem object has an owner, group and permission bits for user/group/other. Read, write and execute have octal values 4, 2 and 1. 640 means owner read/write, group read, others none. On a directory, execute means traversal; read means listing names; write enables adding/removing entries, subject to other controls. A user who can write a directory can often remove entries even when the file itself is read-only. The sticky bit on shared directories restricts deletion of other users' entries. Root and capabilities introduce additional privileges; discretionary permissions are not the only security layer.

Lab

sudo useradd -m -s /bin/bash trainee
sudo groupadd academy
sudo usermod -aG academy trainee
sudo mkdir -p /srv/academy-lab
sudo chown root:academy /srv/academy-lab
sudo chmod 2770 /srv/academy-lab
sudo -u trainee touch /srv/academy-lab/created-by-trainee
ls -ld /srv/academy-lab
ls -l /srv/academy-lab
id trainee

The leading 2 enables setgid on the directory, making new entries inherit its group. usermod -aG appends supplementary groups; omitting -a can remove existing memberships. Existing login sessions may need reconnection to pick up changed groups.

Sudo and service accounts

Use sudo for specific administrative commands. Edit delegated rules with visudo; syntax errors can break administration. Granting unrestricted sudo or membership of the Docker group is effectively broad root-level power. Web services should read site code, while upload/cache paths can be separately writable. Avoid chmod -R 777 as a fix for a 403 error.

ACL extension

Where ACL tools are installed, use getfacl /srv/academy-lab to inspect and setfacl -m u:trainee:rwx /srv/academy-lab for a named-user exception. The ACL mask can reduce effective rights even if an entry seems permissive. Use namei -l /path/to/file to inspect every parent directory when access fails.

Verify and cleanup

Try creating a file as a user outside the group and compare results. Remove the lab user/group only after identifying owned files and processes. Never delete a real account as part of the demonstration.

Official reference

Ubuntu user management

Interview and revision check

Why might a readable file still be inaccessible?

The process needs traversal permission on every parent directory, and web-server or security-policy rules can still deny access.