Unit 5: Permissions · Lesson 2 of 6 · 16 min
Changing modes
chmod, chown and how the kernel decides which set of bits applies to you.
mission
- You are
- You are writing the fix for the exposed secret.
- Situation
- You cannot change deploy's files, but you can practise the exact change on your own copy and write the ticket.
- Goal
- Choose the right mode and test it on a file you own.
- Hand in
- The mode db.env should have.
Practise on your own file
touch notes.txt chmod 600 notes.txt stat -c '%a %A %n' notes.txt 600 -rw------- notes.txt chown dana notes.txt chown: changing ownership of 'notes.txt': Operation not permitted
you should see You can change modes on your own files. Only root can give a file away.
Common modes
| Command | What it does |
|---|---|
chmod 600 file | Owner only. Keys and secrets |
chmod 640 file | Owner writes, group reads. Shared config |
chmod 644 file | Everyone reads. Public files only |
chmod 755 dir | Everyone enters, owner writes |
chmod o-r file | Remove read for others only |
Symbolic modes
Letters set or remove bits without working out octal: u, g, o for who, + - = for how.
cd /tmp && touch report.txt chmod u=rw,g=r,o= /tmp/report.txt && stat -c '%a %A %n' /tmp/report.txt 640 -rw-r----- /tmp/report.txt chmod g-r /tmp/report.txt && stat -c '%a %A %n' /tmp/report.txt 600 -rw------- /tmp/report.txt
you should see 640, then 600.
The fix for db.env
-rw-r--r-- deploy ops db.env
644: anyone reads the password
-rw-r----- deploy ops db.env
640: deploy and the ops group only
What a defender takes away
- 1Owner bits apply to the owner, group bits to members, others to everyone else.
- 2chmod changes modes, chown needs root.
- 3Least privilege: give each file only what its job needs.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.