Linux Permissions, Ownership, Chmod & Chown Security

Lab 04 of 20 · Security & Permissions · 5 hands-on activities · bilingual (English + සිංහල)

පිටුව 04: Linux Permissions, Ownership, Chmod සහ Chown ආරක්ෂක ක්‍රම

Linux පරිශීලක හිමිකම් (User, Group, Others), කියවීම්/ලිවීම් අවසර (r=4, w=2, x=1), chmod 755/644/400 ගණනය කිරීම සහ chown භාවිතය.

Architectural Foundation & Systems Diagram

Linux is a multi-user operating system built on strict least-privilege access control. Every file and directory is owned by a User and a Group, with permissions split into three scopes:

• 👤 Entity Scopes (u / g / o) — • User (u): The individual user account that owns the file.
  • Group (g): The group of users sharing access.
  • Others (o): Everyone else with an account on the machine.

• 🔢 Octal Math: r=4, w=2, x=1 — • Read (r = 4): View file content / list directory.
  • Write (w = 2): Modify or delete file / add directory files.
  • Execute (x = 1): Run script or binary / enter directory.

• 🛡️ Key Production Chmod Values — • 755 (rwxr-xr-x): Standard for executables & scripts.
  • 644 (rw-r--r--): Standard for config files & web assets.
  • 400 (r--------): Mandatory for SSH private keys!

Step-by-step practical lab

Step 01: Inspect File Inode Numbers

සිංහලෙන් — File එකක Inode අංකය (හැඳුනුම්පත) පරීක්ෂා කරමු.

Display the unique filesystem index node (Inode) number assigned to each file by the Virtual File System (VFS).

ls -i Dockerfile

• -i : Index node: ගොනුවේ Inode අංකය පෙන්වයි.

Expected output

1441829 Dockerfile

Step 02: Check Filesystem Disk & Inode Capacity

සිංහලෙන් — Hard Disk එකේ ඉඩ සහ Inodes ප්‍රමාණය පරීක්ෂා කරමු.

Inspect available disk storage and inode capacity across all mounted storage partitions in human-readable format.

df -h

• -h : Human-readable: 10G, 500M වැනි මිනිසාට පහසුවෙන් කියවිය හැකි ඒකක වලින් පෙන්වයි.

Expected output

Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme0n1p1   50G   14G   34G  30% /
/dev/nvme1n1    100G   24G   72G  25% /var/lib/docker

Step 03: Inspect Inode Consumption Ratios

සිංහලෙන් — Inodes පිරී ඇති ප්‍රතිශතය (Inode Exhaustion) පරීක්ෂා කරමු.

Check inode allocation limits across all mounted filesystems to prevent inode exhaustion outages.

df -i

• -i : Inodes: Storage bytes වෙනුවට ගොනු හැඳුනුම්පත් (Inodes) ප්‍රමාණය පෙන්වයි.

Expected output

Filesystem       Inodes  IUsed   IFree IUse% Mounted on
/dev/nvme0n1p1  3276800 412800 2864000   13% /
/dev/nvme1n1    6553600 894200 5659400   14% /var/lib/docker

Hands-on practice activities

Work through these yourself — tick them off as you go.

• Activity 16: List File Attributes and Permissions (Drill) — Print long-format listing with permissions, owners, file size, and timestamps.
• Activity 17: Query Current Effective User Identity (Drill) — Print effective user name to confirm whether you are operating as unprivileged sre-engineer or superuser root.
• Activity 18: Query User UID and Group GIDs (Drill) — Inspect numeric User ID (UID), primary Group ID (GID), and all supplementary group memberships.
• Activity 19: Security Rule: Never Run 'chmod 777' (Checkpoint) — Never execute 'chmod 777' in production! It allows any local process or compromised service to overwrite code or inject backdoors.
• Activity 20: Octal Permission Calculation Quiz (Quiz) — What is the numeric octal value for Read + Execute permissions? Answer: 5 (4 + 1).

Keep going: ← Lab 03 · Lab 05 → · Track your progress in the Self Guide