Instruction 03-users-groups-permissions-and-least-privilege: Reading

Linux authorization begins with process credentials. A process has user and group identifiers, while a file has an owning UID, an owning GID, mode bits, and possibly an ACL. Names such as alice or operators are convenient labels; the kernel ultimately evaluates numeric identifiers. The id command reports the credentials associated with a user, while getent queries the system's configured identity sources without assuming that all accounts come from local files.

Traditional mode bits contain three permission classes: owner, group, and other. The kernel selects the applicable class rather than combining all three classes. If the process UID matches the file owner, the owner bits apply. Otherwise, if one of the process groups matches the file group, the group bits apply. Otherwise, the other bits apply. A POSIX ACL extends this model with named user and group entries and an ACL mask. Because the mask can reduce effective access, getfacl is often more informative than looking only at the compact mode display.

Permissions mean different things for files and directories. Reading a regular file permits reading its contents. Writing permits changing its contents. Execute permits attempting to run it as a program, subject to format, interpreter, mount, and policy constraints. On a directory, read permits listing names, write permits creating or removing directory entries, and execute permits traversal. Removing a file is therefore primarily controlled by the parent directory, not by the file's write bit. Access to a deep path also requires traversal through every parent directory. The namei command is useful when a leaf file appears readable but an ancestor blocks access.

Groups are usually the cleanest way to delegate shared access because they describe roles instead of one-off exceptions. ACLs are useful when a named user needs a narrow exception, such as read-only access to one report. Excessive ACL entries can become difficult to audit, so they should not replace thoughtful group design. Group membership changes may not appear in an already running process because credentials are normally established when the session begins.

Least privilege is both a design rule and an operational process. Begin with no access, grant the smallest required permission, test the intended action, test that prohibited actions still fail, and remove access when the task ends. Avoid treating elevated execution as a default workflow. Elevated identities can bypass ordinary discretionary controls, so successful testing as an administrator does not prove that an application identity has correct access. This class deliberately avoids creating accounts or editing system identity databases. It uses existing identities and changes only the isolated class directory.