Permissions & Ownership – Linux Teaching Plan

This 3‑hour module equips students with the skills to set, modify, audit and troubleshoot Linux file and directory permissions and ownership. The plan is designed for users who already know how to navigate the filesystem and want to enforce security policies.

Learning Objectives

• Interpret the output of ls -l and stat.
• Set permissions with symbolic and octal notation.
• Change file ownership and group ownership.
• Use umask to control default permission bits.
• Apply ACLs with getfacl and setfacl.
• Employ special mode bits (setuid, setgid, sticky).
• Audit permissions on many files using find with -perm, -user, -group.
• Diagnose common permission problems and fix them.
• Automate permission changes with shell scripts.

Schedule & Topics

1. Introduction & ls -l (5 min)
2. Octal vs Symbolic chmod (10 min)
3. Ownership with chown & chgrp (10 min)
4. Default bits – umask (10 min)
5. Special modes – setuid, setgid, sticky (10 min)
6. Access Control Lists – getfacl & setfacl (15 min)
7. Auditing – stat, find -perm, find -user (15 min)
8. Problem‑solving – common permission errors (10 min)
9. Mini‑project & Automation (15 min)
10. Q&A & Wrap‑up (10 min)

Command Topics & Hands‑On Exercises

ls -l /home/youruser
ls -l file.txt

stat file.txt
stat --format '%A %n' file.txt

chmod 644 file.txt
chmod 600 script.sh
chmod 777 directory

chmod u+x file.txt
chmod g-w file.txt
chmod o= file.txt
chmod u=rwx,g=rx,o= file.txt

chown user file.txt
chown user:group file.txt
chown -R user:group dir/

chgrp staff file.txt
chgrp -R staff dir/

umask
umask 022
umask 027
umask 077

getfacl file.txt
getfacl -R dir/

setfacl -m u:alice:rw file.txt
setfacl -m g:devops:r-- dir/
setfacl -b file.txt           # remove all ACLs

find . -perm 644 -type f
find /tmp -perm /g=w   # files writable by group
find /tmp -perm -g=w  # files with group write bit set

find /var/log -user root -type f
find /tmp -group staff -type d

chmod g+s project/
ls -ld project/

chmod +t /tmp/shared
ls -ld /tmp/shared

getent passwd | grep alice
getent group | grep devops

id
id alice
id -Gn

# install auditd on the test machine
sudo apt-get install auditd
sudo auditctl -w /home/youruser -p wa -k home_changes
sudo ausearch -k home_changes

Practice Workshop (Hands‑On)

Students are paired and each receives a /tmp/perm_tutorial folder pre‑populated with files and directories of varying ownership/permissions. They will complete all the exercises, then exchange their setups for peer review.

• Always check with ls -l or stat before changing.
• Use -i with chmod / chown when experimenting.
• Take backups of critical files before applying ACLs.

Assessment

1. Quiz (5 min): 5 rapid questions about notation, command syntax and expected output.
2. Mini‑Project (15 min): Write a script that:
   1. Creates a directory /tmp/safe with permissions 2750 (setgid + r-x for owner & group).
   2. Copies all .conf files from /etc into it.
   3. Sets ACL to allow user alice full access while denying all other users.
   4. Prints the final permission state with getfacl.
3. Peer review: each student runs another’s script and comments on correctness.

Resources & Further Reading

• man chmod
• man chown
• man chgrp
• man umask
• man setfacl
• man getfacl
• man ls
• man stat
• man find
• Auditd Tutorial (RedHat)

Feel free to adjust the pacing or replace optional commands (e.g., auditd) with other tools such as selinux commands if your audience already knows ACLs.