LINUX FIELD GUIDE // 01
Create and audit Linux files with deliberate permissions
Inspect location and ownership before creating files, then verify directory and file permissions separately.
A shared server contains unfamiliar files and permissions that must be handled safely.
BEFORE YOU START
Prerequisites and boundaries
- Practice as a non-root user in a disposable directory.
- Identify the user and group that should read or modify the target.
- Remember that directory execute permission controls traversal, not program execution.
OPERATIONAL REASONING
Why this sequence matters
The goal is not merely to memorize commands. Each inspection, change, and verification step reduces a different failure mode.
Confirm the target path
Relative paths depend on the current directory, so pwd is part of the safety check.
Separate directory and file modes
Directories need traversal permission while regular files usually do not need an execute bit.
Verify symbolic and numeric modes
ls and stat provide complementary views of ownership and permission bits.
STANDARD PROCEDURE
Create a private log directory and file with deliberate permissions.
Confirm the location, create the hierarchy and file, then restrict directory traversal and file access separately.
- 01
- 02
mkdir -p project/logsGNU mkdir documentation ↗ - 03
touch project/logs/app.logGNU touch documentation ↗ - 04
chmod 750 project/logsGNU chmod documentation ↗ - 05
chmod 640 project/logs/app.logGNU chmod documentation ↗
INCIDENT RESPONSE
Audit and secure a configuration file that may expose credentials.
Locate and inspect the file before restricting it to its owner, then verify the final permission bits.
- 01
- 02
ls -l config.envGNU ls documentation ↗ - 03
stat config.envGNU stat documentation ↗ - 04
chmod 600 config.envGNU chmod documentation ↗ - 05
stat -c "%a %n" config.envGNU stat documentation ↗
COMMON FAILURE MODES
What usually goes wrong
- A recursive chmod removed execute permission from directories and made them inaccessible.
- A relative path created or changed files in the wrong directory.
- Permissions were tightened but ownership still granted access to the wrong account.
VERIFICATION
Evidence to collect
- pwd and readlink -f identify the expected target location.
- stat reports the intended owner, group, and numeric mode.
- Access is tested with the same user or service account that will use the file.