Topic 2 · Deep Dive

2.3 Files, Folders, Permissions, and Devices

Mode Bits Are Three Slots of Three Bits

POSIX permissions store nine bits per object, split into owner, group, and other, each holding read (4), write (2), and execute (1). chmod 640 notes.txt therefore means owner 6 = 4+2 (read/write), group 4 (read), other 0 (nothing); ownership is set separately with chown dev:sec notes.txt. New files inherit a ceiling from umask: with the common umask 022, a created file lands as 644 and a directory as 755, which is why world-readable by default is a policy choice, not an accident. On the kernel side the check is a lookup: for each access, the kernel picks exactly one row of the grid based on who you are, and that row alone decides, so a "wrong" row can silently deny or grant.

Folders Change the Meaning of Each Bit

On a directory, the bits mean something different: r lists entry names, w creates or renames entries, and x lets you traverse into it. That is why a directory with rw- but no x still produces "Permission denied" when you cd into it, and why x without r (mode 711) is the classic "traverse but don't browse" setup. Special bits add behavior: 1777 on /tmp is the sticky bit, so users delete only their own files; 4755 marks a setuid program, which runs with the file owner's privileges and is a standing privilege-escalation candidate. Audit them with find / -perm -4000 -type f before trusting a system.

ACLs, Windows ACEs, and Device Nodes

Nine bits cannot express "give the audit group read too," so extended ACLs layer named entries on top: setfacl -m g:sec:rx report.csv, verified with getfacl, whose trailing + in ls -l signals an ACL exists. Windows does the same job with access control entries and inheritance flags: icacls C:\data /grant "CORP\Audit:(OI)(CI)RX" grants read-and-traverse that flows down to new children, and explicit deny ACEs win over any grant. Finally, remember that devices are files: Linux exposes block and character devices as /dev/sda and /dev/tty0, commonly crw-rw---- 1 root disk, with membership in the disk group amounting to raw-disk access. Removable media should mount with nodev,noexec, and Windows Storage Spaces should keep SAN policy OfflineShared so foreign disks do not auto-mount.

Architecture Diagram

Who you are picks the row; the file's mode bits pick the cells, so only one row ever decides access.

Key Takeaways

Permissions are nine bits in three rows; the kernel evaluates only the first row that matches your identity.
Octal arithmetic is the skill: 750 means rwx r-x ---, and umask sets the default for new objects.
On directories, x is traverse and w is create/rename; missing x is the most common "why can't I read this" bug.
ACLs (setfacl) and Windows ACEs (icacls) extend the nine-bit model; deny entries and inheritance change the outcome.
Devices are files in /dev, so group membership such as disk is a privilege; mount removable media with nodev,noexec.

« Back to Topic 2 — « 2.2 / 2.4 »