Understand posix modes, acl evaluation, special bits and test the resulting controls with reproducible evidence.
45 min 150 XPSkills: POSIX modes, ACL evaluation, Special bits
Brief
Northwind Freight needs defensible evidence for filesystems and permissions, not a vocabulary quiz. Start with the system boundary and trace how a technical state changes the confidentiality, integrity or availability of the service. A passing document is not a passing running system.
You will examine posix modes, acl evaluation, special bits, then make short incident decisions and author a testable specification. Keep desired state, observed state and evidence separate: an approved requirement tells you what should happen, while a dated observation tells you what actually happened.
Never convert missing evidence into a passing control result.
Modes are access calculations
A filesystem maps names to objects and stores ownership, type and permissions as metadata. A hard link is another directory entry for the same object; a symbolic link stores a path and may break when its target moves. Removing a name is different from overwriting its data, and an open descriptor may keep an unlinked object accessible.
POSIX mode digits sum read=4, write=2 and execute=1 separately for owner, group and other. Mode 0640 grants owner read/write, group read and others nothing. On directories, execute means traversal; read lists names and write permits changing entries when combined with traversal. A writable file is not required to unlink its name from a writable parent.
Access controls need parent-directory context and effective identity. Capture ownership, modes and the complete ancestor path; an auditor asks whether the apparent restriction survives traversal and group-membership evaluation.
Modes are access calculations requires both a declared boundary and independently testable observations.
ACLs and inheritance
An ACL can grant named users or groups rights beyond the traditional three classes. In a POSIX ACL, the mask limits effective rights for named users, named groups and the owning group, but not the owner entry. Inspect effective rights as well as the printed entry; a named write grant limited by a read-only mask cannot write.
Default directory ACLs influence newly created objects, not necessarily existing children. Permission changes and inheritance behavior differ across filesystem families, so test with the actual mount and creation mode. A creation mask such as 0027 removes permission bits from requested defaults; it does not add permissions that the application never requested.
Access-review evidence includes ACL entries, masks, parent defaults and resulting child access. An auditor asks for a test performed as the intended user, rather than a screenshot of an inheritance checkbox.
ACLs and inheritance requires both a declared boundary and independently testable observations.
Special bits and dangerous shortcuts
The setuid bit on a supported executable changes its effective user identity to the file owner when executed. It is not an instruction to encrypt the file, and setuid script handling varies. Review ownership and writable paths carefully: allowing an untrusted user to replace privileged executable content can become code execution with elevated rights.
The sticky bit on a shared writable directory restricts deletion or renaming of entries to permitted owners or privileged users. Mode 1777 still allows file creation and does not make every contained file private. The setgid bit on a directory commonly causes new children to inherit its group; this is distinct from setuid execution behavior.
Privileged-file controls need exception inventories and periodic comparisons. Keep special-bit scans and documented business justification; an auditor asks who can modify the executable or its parent directory and when that permission was last tested.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Three digits, two objects
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A report needs owner read/write, group read and no other access. The parent needs owner full access, group list/traverse and no other access. A teammate swaps the modes, calling execute a file-read flag.
Term bank, not all of these are right
640750777600
1.1What three-digit mode belongs to the file? (three digits)
1.2What three-digit mode belongs to the parent? (three digits)
Task 2: The grant that is limited
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A named-user entry grants write, but its effective rights are limited by another ACL entry. A default directory policy affects new children; the manager claims it automatically rewrites all existing files.
Term bank, not all of these are right
ACL maskdefault ACLfile ownersetgid
2.1Which ACL entry limits the named-user grant? (two words)
2.2Which ACL applies to newly created children? (two words)
Task 3: Shared directory, private executable
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A shared writable directory must stop users deleting each other's entries. A separate executable runs with its owner's effective identity. The owner calls both features encryption.
Term bank, not all of these are right
sticky bitsetuidsetgidread-only
3.1Which special permission restricts shared-directory deletion? (two words)
3.2Which special permission changes effective user on execution? (one word)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Lab 1 · YAML lab
Build the filesystems and permissions specification
The control owner calls the current summary complete because every field has a label. Several labels confuse a technical mechanism with assurance, and missing observations have been treated as passing.
Use the fixture as the authoritative requirement. Replace the empty fields with typed, testable values and identify the evidence needed to substantiate the claim. Do not copy the owner's optimistic summary.
Approved requirement and measured facts
Private report: owner read/write, group read, others none. Parent: owner full, group read/traverse, others none. No privilege-changing execution bit is allowed. Record effective ACL and parent directory.
The owner says all six statements are acceptable because they use technical vocabulary. Judge the actual claim, not the confidence of its author.
Accept accurate limited mechanism statements; reject false equivalence, excessive privilege, absent evidence, or conclusions beyond the observation.
Verdicts are accept or reject. Every rejection needs one reason code from: wrong-mechanism | excess-privilege | missing-evidence | unsupported-claim.
Claims submitted for assurance
IT3-1 A filesystem maps names to objects and stores ownership, type and permissions as metadata.
IT3-2 Treat "750" as interchangeable with "640"; no mechanism check is needed.
IT3-3 Let every employee modify the protected service configuration without approval or review.
IT3-4 An ACL can grant named users or groups rights beyond the traditional three classes. This statement describes the mechanism only, not a complete audit conclusion.
IT3-5 Report a pass when the required observation is missing; no dated source is retained.
IT3-6 Claim that a documented posix modes policy proves every in-scope asset complied throughout the year.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · IT Fundamentals
Command Line and Safe Automation
Understand posix shell, exit handling, evidence collection and test the resulting controls with reproducible evidence.
