Tutorial 16-17

Q1 Collaborative Directory Setup

The engineering team requires a shared collaboration folder. Create and configure a directory named /shared/alpha to meet the following precise requirements:

Ownership

The directory must be owned by the user john and belong to the group devs.

Permissions

The owner (john) and members of the group (devs) must have full read, write, and execute permissions on the directory.
All other users (others) should only have read and execute permissions.

Special Bits

Ensure that any new files or subdirectories created inside /shared/alpha automatically inherit the group ownership of devs, regardless of which user creates them.

Persistence

These permissions must apply recursively to any existing files currently inside /shared/alpha.

Grading Criteria

ls -ld /shared/alpha should display permissions showing drwxrwsr-x, owner john, and group devs.

Solution

Create new directory
- mkdir -p /shared/alpha
Create new user
- useradd john
Create new group
- groupadd devs
Change folder owner
- chown -R john:devs /shared/alpha
Change permission
- Numeric Mode: chmod -R 2775 /shared/alpha
- Symbolic Mode: chmod -R u=rwx,g=rwx,o=rx,g+s /shared/alpha
Verify owner and permission
- ls -ld /shared/alpha
- 3rd column --> File/folder owner
- 4th column --> Group owner
Cleanup
- rm -rf /shared/alpha
- userdel -r john
- groupdel devs

Q2 Restricting Execution & Directory Traversal

You are handed a legacy project directory located at /opt/project. The permissions are currently messy and insecure.

Clean up the directory permissions according to these rules:

Modify the permissions of /opt/project and all its contents recursively so that all users (user, group, and others) have execute permissions, but only if the item is a directory or already has execute permissions for someone.
Do not grant execute permissions to plain text files that don't need it.

Grading Criteria

Directories should be accessible (x), but standard .txt or configuration files should not become executable.

Solution

Create new directory
- mkdir -p /opt/project
Modify permission without execute, let's set user as example
- Symbolic Mode: chmod -R u-X /opt/project
Create text file
- touch /opt/project/standard.txt
Check permission
- Folder: ls -ld /opt/project
- File: ls -l /opt/project
Modify Permission
- Symbolic Mode: chmod -R a+X /opt/project
Verification
- ls -ld /opt/project
- /opt/project will become drwxr-xr-x (gained x).
- standard.txt will remain -rw-r--r-- (did not gain x).
Cleanup
- rm -rf /opt/project

Q3 Enforcing a Strict Security Policy (Umask)

The system security policy mandates that any new files or directories created by the user john must be highly restrictive by default to prevent data leaks.

Configure the environment for the user john so that any future files he creates default to permissions of -rw------- (read/write for owner only, no access for anyone else).
Any future directories he creates must default to drwx------.
This configuration must be permanent and survive system reboots.

Grading Criteria

Log in as john, run source on the modified profile file, create a file using touch, and verify with ls -l that the permissions are exactly 600.

Solution

Calculate umask value
- File permission: -rw------- = 600
- Folder permission: drwx------ = 700
- umask = 177OCT
  - File : 666OCT &(~177OCT) = 600OCT
  - Folder: 777OCT &(~177OCT) = 600OCT
- umask = 77OCT
  - File : 666OCT &(~77OCT) = 600OCT
  - Folder: 777OCT &(~77OCT) = 700OCT
- umask = 77OCT
Create new user
- useradd john
Update password of new user
- passwd john
Login as user john
- su - john
Change the umask value permanently
- Open .bashrc by using vim editor : vim /home/john/.bashrc --> Esc --> I --> Enter
- Edit/Add new line umask 077
- Save and exit: Esc -->:wq --> Enter
Update setting immediately
- source ~/.bashrc
Check umask value
- umask
Create new directory
- mkdir testdir
Create new file
- touch test.txt
Verification
- ls -ld testdir
  - Permission: drwx------
- ls -l test.txt
  - Permission: -rw-------
Cleanup
- rm -rf testdir
- rm -rf test.txt
- exit
- userdel -r john

Q4 Advanced Shared Space with Restricted Deletion

Configure an existing directory /project/beta to act as a public drop-box for a team, satisfying these conditions:

Ownership

Change the owner to john and the group to devs for the directory and everything inside it.

Permissions

The owner and group must have full control (rwx). Others must have read and execute access (r-x).

Protections

Users within the devs group will be creating files here, but they must be prevented from deleting or renaming each other's files. Only the file owner or root should be able to delete a file within /project/beta.

Grading Criteria

ls -ld /project/beta should show the final permission string ending in t (e.g., drwxrwxr-t or drwxrwsr-t if combined with SGID).

Solution

Create new directory
- mkdir -p /project/beta
Create new user
- useradd john
Create new group
- groupadd devs
Change folder owner
- chown -R john:devs /project/beta
Change permission
- Numeric Mode: chmod -R 3775 /project/beta
- Symbolic Mode: chmod -R u=rwx,g=rwx,o=rx,g+s,o+t /project/beta
Verify owner and permission
- ls -ld /project/beta
- 3rd column --> File/folder owner
- 4th column --> Group owner
Cleanup
- rm -rf /project/beta
- userdel -r john
- groupdel devs

Page updated

Google Sites

Report abuse