🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Linux for Cybersecurity › Lesson 3
TEC-CYBE44-04 · Lesson 3 · 14.5 clock hours · theory

Linux File System Hierarchy and Permissions

Objective. Students explain the Filesystem Hierarchy Standard and configure file ownership and permissions using chmod, chown, and ACLs to enforce least privilege.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

The Filesystem Hierarchy Standard (FHS)

Linux organizes all files under a single root directory, written as `/`. The Filesystem Hierarchy Standard (FHS) defines where files and directories belong so that administrators and security professionals can predict where to find — and protect — critical resources. Understanding this layout is foundational to enforcing least privilege, one of the core principles tested on CompTIA Security+ and CySA+.

Security-Significant Directories

Linux File Permissions

Every file and directory has an owner (a user) and a group, plus a three-part permission set: owner, group, and others (sometimes called "world"). Each part carries three bits: read (r = 4), write (w = 2), and execute (x = 1).

The command `ls -la` displays permissions as a ten-character string, for example:

```

-rwxr-x--- 1 alice devs 4096 Jun 1 09:00 script.sh

```

Reading left to right: the leading `-` indicates a regular file; `rwx` means the owner (alice) can read, write, and execute; `r-x` means members of the group `devs` can read and execute but not write; `---` means all others have no access.

chmod — Changing Permissions

`chmod` accepts symbolic or octal notation.

For security work, octal notation is preferred because it sets the full permission state explicitly rather than making relative changes.

chown — Changing Ownership

`chown user:group file` sets both owner and group in one command. Only root can give a file to a different user. Example:

```bash

sudo chown root:adm /var/log/auth.log

```

This assigns root as owner and the `adm` group as the group, a common baseline on many distributions.

Special Permission Bits

POSIX Access Control Lists (ACLs)

Standard Unix permissions allow only one owner, one group, and "others." When finer-grained control is needed — for example, granting a read-only analyst account access to `/var/log` without adding them to the `adm` group — POSIX ACLs provide the answer.

Always verify access by logging in as the target user in a separate terminal and attempting the expected operations. Never assume a permission change worked without testing.

Applying Least Privilege

NIST SP 800-123 (Guide to General Server Security) recommends that services run with the minimum permissions required. Practically, this means:

1. Audit permissions regularly with `find / -perm -0002 -type f` to locate world-writable files.

2. Remove setuid/setgid bits from binaries that do not require them.

3. Confirm `/tmp` always carries the sticky bit.

4. Use ACLs for granular access rather than broadening group membership.

5. Document all permission changes — before and after states — for audit trails.

Safety Note

When practicing on a shared or production system, avoid running `chmod -R` (recursive) without careful review; a single incorrect recursive command can lock all users out of critical directories or expose sensitive files. Always work on a dedicated lab VM, take a snapshot before making changes, and validate each change with `ls -la` and `stat` before moving on.

Key terms8

Filesystem Hierarchy Standard (FHS)A specification that defines the directory structure and directory contents in Linux and Unix-like operating systems, establishing where system, user, and variable data should reside.
Least PrivilegeA security principle requiring that users, processes, and systems are granted only the minimum permissions necessary to perform their intended functions.
Octal NotationA numeric method of expressing Linux file permissions where each digit represents the sum of read (4), write (2), and execute (1) bits for owner, group, and others respectively.
chmodA Linux command used to change the read, write, and execute permissions of files and directories using either symbolic or octal notation.
chownA Linux command used to change the owning user and/or group of a file or directory; typically requires root privileges to reassign ownership to another user.
POSIX Access Control List (ACL)An extended permission mechanism that allows administrators to define specific read, write, or execute rights for individual users or groups beyond the standard owner/group/others model, applied with setfacl and inspected with getfacl.
Sticky BitA special permission bit applied to directories that restricts file deletion so that only the file's owner or root can remove it, even when the directory is world-writable; commonly set on /tmp.
Setuid BitA special permission bit on an executable file that causes the program to run with the privileges of the file's owner rather than the user who launched it, posing a privilege-escalation risk if misapplied.

Worked examples4

1. A file called report.txt is currently set to permissions 777 (rwxrwxrwx), owned by user alice, group staff. Apply least-privilege permissions so that alice can read and write, members of staff can read only, and all others have no access.
  1. Determine the required permission bits: owner needs read+write = 4+2 = 6; group needs read only = 4; others need nothing = 0. Combined octal value: 640.
  2. Run the command: chmod 640 report.txt
  3. Verify with: ls -la report.txt — expected output shows -rw-r----- with owner alice and group staff.
  4. Confirm no execute bit is set on a data file, which would be unnecessary and potentially risky.
Answer: chmod 640 report.txt sets the permissions to -rw-r-----, satisfying least privilege for this scenario.
2. A directory /var/log/app is owned by root:root with permissions 755. Grant the user analyst read and execute access to the directory using a POSIX ACL without changing group membership or standard permissions.
  1. Confirm current state: ls -la /var/log/ | grep app and getfacl /var/log/app — note no existing ACL entries.
  2. Apply the ACL entry: sudo setfacl -m u:analyst:r-x /var/log/app
  3. Verify the ACL was applied: getfacl /var/log/app — the output should show a line 'user:analyst:r-x'.
  4. Confirm the ls -la output now shows a '+' at the end of the permission string for the directory.
  5. In a second terminal logged in as analyst, run ls /var/log/app to confirm read access is granted and touch /var/log/app/test.txt fails (no write permission).
Answer: sudo setfacl -m u:analyst:r-x /var/log/app grants analyst read and execute access via ACL, verifiable with getfacl and confirmed by testing in a second terminal session.
3. Calculate the octal permission value for a file that should be: owner=read+write+execute, group=read+execute, others=read only.
  1. Owner: read(4) + write(2) + execute(1) = 7
  2. Group: read(4) + write(0) + execute(1) = 5
  3. Others: read(4) + write(0) + execute(0) = 4
  4. Combine the three digits in order: 754
Answer: The octal permission value is 754, applied with chmod 754 filename.
4. A sysadmin runs 'find / -perm -0002 -type f 2>/dev/null' and finds /etc/passwd has permissions 666. Explain the security risk and provide the correct remediation command.
  1. Analyze the risk: permissions 666 (rw-rw-rw-) mean any user on the system can write to /etc/passwd, allowing them to modify user account entries, add new accounts, or corrupt authentication data.
  2. Determine the correct permissions: /etc/passwd should be readable by all (needed for username-to-UID lookups) but writable only by root — octal 644.
  3. Confirm ownership: sudo chown root:root /etc/passwd to ensure root owns the file.
  4. Set correct permissions: sudo chmod 644 /etc/passwd
  5. Verify: ls -la /etc/passwd should show -rw-r--r-- root root.
Answer: Run 'sudo chown root:root /etc/passwd && sudo chmod 644 /etc/passwd'. This removes world-write access while keeping the file readable system-wide as required.
In class: Draw and label the FHS directory tree (/, /etc, /var, /home, /usr, /tmp, /proc, /sys) and describe the security significance of each; peer-review with a partner. · Instructor presents a misconfigured directory with world-writable system files; students identify each violation using ls -la and stat, then correct permissions using symbolic and octal chmod notation, documenting before/after states. · Apply POSIX ACLs with setfacl/getfacl to grant a read-only analyst account access to /var/log without modifying group membership; verify with a second terminal logged in as that user.
Materials: Linux VM, Linux man pages (chmod, chown, setfacl), NIST SP 800-123 (Guide to General Server Security), CompTIA Security+ exam objective list (domain: Implementation)
Check: Lab worksheet requiring students to predict and verify permission bits before and after changes; pass = 85% of permission scenarios correctly resolved and documented.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ — Implementation (Secure Protocols and Host/Application Security)
1. A security analyst finds a file in /tmp owned by a regular user with permissions rwxrwxrwx. Which single chmod command best applies least privilege so that only the file owner can read, write, and execute the file?
CompTIA Security+ — Implementation (Identity and Access Management)
2. Which directory in the Linux FHS contains hashed user passwords and must be readable only by root to protect credentials?
CompTIA Security+ — Implementation (Identity and Access Management)
3. An administrator needs to give user 'auditor' read access to /var/log without adding auditor to any new groups. Which approach is most appropriate?
CompTIA CySA+ — Security Operations (System and Network Architecture)
4. A junior administrator sets permissions on the /etc/ssh/sshd_config file to 666. What is the primary security risk?
CompTIA Security+ — Implementation (Secure Configurations)
5. What does the sticky bit do when applied to a directory such as /tmp?
CompTIA CySA+ — Vulnerability Management
6. A file has the permission string -rwsr-xr-x. What does the 's' in the owner execute position indicate?
CompTIA Security+ — Implementation (Identity and Access Management)
7. Which command would an analyst use to display all ACL entries currently applied to the file /var/log/auth.log?
ISC2 CC — Security Principles / CompTIA Security+ — Implementation
8. During a security audit, you run 'find / -perm -0002 -type f 2>/dev/null' and receive several results under /usr/bin. Which NIST guidance document is most directly relevant to remediating these findings on a Linux server?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →