Topic 4 · Deep Dive

4.2 File Permissions, System Files, and Processes

Reading the Mode Bits

POSIX permissions pack three bits -- read, write, execute -- per class (owner, group, other) into one octal digit. The mode 0755 decodes to rwxr-xr-x: the owner may write and execute, while group and other may only list and run. Four special bits ride above the octal triad: setuid (4000), setgid (2000), and sticky (1000). A setuid binary runs with the owner's UID regardless of who launches it, which makes every such file an audit target. Find them with find / -xdev -perm -4000 -type f and question each one you cannot name. Set defaults deliberately with umask 027 so new files never start world-readable, and change ownership with chown root:root, never chmod 777 as a shortcut.

Guarding System Files

Credential stores must be unreadable to ordinary users. On a healthy Linux host, /etc/passwd is 0644 (name mapping only) while /etc/shadow is 0640 root:shadow or stricter, so hashes stay out of reach of offline cracking. Windows protects equivalents with ACLs on %SystemRoot%\System32\config\SAM, readable only by SYSTEM. Inspect and fix Windows ACLs with icacls: icacls file /grant svc:(R) adds read, and icacls file /inheritance:r strips leaked inherited entries. Where supported, mark critical binaries immutable with chattr +i /usr/bin/sudo so even root must clear the flag first.

Tracking Running Processes

Permissions protect files at rest; processes are the same files executing, so track the chain. Run ps -ef --forest to see parent-child relationships; a web server shell should spawn worker processes, and anything else (like /bin/bash as a child of httpd) is suspicious. Confirm the on-disk truth of a running process by resolving /proc/1234/exe, and check which files it holds open with lsof -p 1234. On Windows, Get-Process | Select-Object -Expand Path or Process Explorer reveals each process's image path and digital signature status.

Integrity Spot Checks

Binaries with correct permissions can still be tampered files. Verify vendor trust: rpm -Va or debsums -s compare installed files against package metadata hashes, and Get-AuthenticodeSignature C:\Windows\System32\svchost.exe must return Valid. Watch the classic impersonation tricks -- /usr/bin/sshd versus /usr/sbin/sshd, or a process running from %APPDATA% while claiming to be a system service -- and alert on any system binary that changed size or hash without a matching patch event.

Architecture Diagram

One binary, two views: octal mode bits gate who may touch the file; the process tree shows who is running it now.

Key Takeaways

Each octal digit is three bits (r=4, w=2, x=1) per class; 0755 means owner-writable, world-readable.
Setuid binaries run as their file owner, so inventory them with find / -perm -4000.
Keep /etc/shadow root/shadow-only and SAM protected by SYSTEM ACLs; fix Windows ACLs with icacls.
Trace parent-child chains with ps --forest and verify images via /proc/PID/exe or signature checks.
Permissions alone are not integrity: confirm hashes with rpm -Va, debsums, or Authenticode.

« Back to Topic 4 — « 4.1 / 4.3 »