LINUX FIELD GUIDE // 01

Create and audit Linux files with deliberate permissions

Inspect location and ownership before creating files, then verify directory and file permissions separately.

Scenario

A shared server contains unfamiliar files and permissions that must be handled safely.

BEFORE YOU START

Prerequisites and boundaries

  • Practice as a non-root user in a disposable directory.
  • Identify the user and group that should read or modify the target.
  • Remember that directory execute permission controls traversal, not program execution.

OPERATIONAL REASONING

Why this sequence matters

The goal is not merely to memorize commands. Each inspection, change, and verification step reduces a different failure mode.

01

Confirm the target path

Relative paths depend on the current directory, so pwd is part of the safety check.

02

Separate directory and file modes

Directories need traversal permission while regular files usually do not need an execute bit.

03

Verify symbolic and numeric modes

ls and stat provide complementary views of ownership and permission bits.

STANDARD PROCEDURE

Create a private log directory and file with deliberate permissions.

Confirm the location, create the hierarchy and file, then restrict directory traversal and file access separately.

  1. 01
  2. 02
    mkdir -p project/logsGNU mkdir documentation
  3. 03
    touch project/logs/app.logGNU touch documentation
  4. 04
    chmod 750 project/logsGNU chmod documentation
  5. 05
    chmod 640 project/logs/app.logGNU chmod documentation

INCIDENT RESPONSE

Audit and secure a configuration file that may expose credentials.

Locate and inspect the file before restricting it to its owner, then verify the final permission bits.

  1. 01
  2. 02
    ls -l config.envGNU ls documentation
  3. 03
  4. 04
    chmod 600 config.envGNU chmod documentation
  5. 05
    stat -c "%a %n" config.envGNU stat documentation

COMMON FAILURE MODES

What usually goes wrong

  • A recursive chmod removed execute permission from directories and made them inaccessible.
  • A relative path created or changed files in the wrong directory.
  • Permissions were tightened but ownership still granted access to the wrong account.

VERIFICATION

Evidence to collect

  • pwd and readlink -f identify the expected target location.
  • stat reports the intended owner, group, and numeric mode.
  • Access is tested with the same user or service account that will use the file.