Navigating the filesystem and permissions

Almost every Linux security question eventually becomes a permissions question: who can read this file, who can change it, and what runs with whose rights? This module gives you the map and the vocabulary.

What you will learn

The purpose of the key directories in the Linux filesystem.
How to read ls -l output and the read / write / execute model.
How to change permissions and ownership safely.
Special bits — SUID, SGID and sticky — and why attackers look for them.

Run every exercise in a lab virtual machine (for example Ubuntu Server or Debian in VirtualBox, VMware or UTM) — never on a production system or a machine you do not own.

The filesystem map

Linux has a single directory tree that starts at /. The directories you will meet most in security work:

/etc — system configuration (users, SSH, services). Changes here change behaviour.
/var/log — logs. Your first stop during an investigation.
/home and /root — user and administrator home directories.
/tmp and /var/tmp — shared scratch space, writable by everyone; a favourite place to drop malware.
/usr/bin, /usr/sbin — installed programs.
/proc — a live view of running processes and kernel state (not real files on disk).

pwd                 # where am I?
ls -la /etc         # list everything, including hidden files, with details
cd /var/log         # change directory
cd ~                # back to your home directory
file /bin/ls        # what kind of file is this?

Reading permissions

Every file has an owner, a group, and three sets of permissions: for the owner, for the group, and for everyone else. r = read, w = write, x = execute (for directories, x means “may enter”).

$ ls -l /etc/passwd /etc/shadow
-rw-r--r-- 1 root root   2245 Oct 20 09:12 /etc/passwd
-rw-r----- 1 root shadow 1290 Oct 20 09:12 /etc/shadow
 │└┬┘└┬┘└┬┘   └┬─┘ └─┬──┘
 │ │  │  │     │     └─ group owner
 │ │  │  │     └─────── user owner
 │ │  │  └─ others: r--  (read)
 │ │  └──── group:  r--  / r--
 │ └─────── owner:  rw-  (read + write)
 └───────── type: - file, d directory, l symlink

Notice that /etc/passwd is world-readable (programs need it to map user IDs to names), while /etc/shadow, which holds password hashes, is not. If /etc/shadow were readable by everyone, any user could copy the hashes and try to crack them offline.

Changing permissions

Permissions are often written as three octal digits: read = 4, write = 2, execute = 1, added together for owner, group and others. So 640 is rw-r-----.

touch notes.txt
chmod 640 notes.txt          # rw- r-- ---
chmod u+x,g-r script.sh      # symbolic form: add execute for owner, remove read for group
sudo chown alice:devs report.txt
umask                        # default mask, often 0022 → new files 644, dirs 755

Special bits

SUID (s in the owner execute position): the program runs with the file owner’s rights. /usr/bin/passwd is SUID root so normal users can update their own password.
SGID: runs with the file’s group rights; on directories, new files inherit the directory’s group.
Sticky bit (t) on a directory: users can delete only their own files. /tmp must have it.

A SUID-root program that lets you run commands or edit files is an instant privilege-escalation path. That is why auditing them is a standard hardening — and attacking — step.

Hands-on lab

Run ls -ld /tmp and confirm the sticky bit is set (drwxrwxrwt).
Create a file, then use chmod so only you can read and write it. Verify with ls -l.
Run the audit commands below and save the output to ~/baseline-suid.txt. You will compare against it later.

# SUID programs (run with the file owner's rights — usually root)
find / -xdev -type f -perm -4000 2>/dev/null

# World-writable files (anyone can modify them)
find / -xdev -type f -perm -0002 2>/dev/null

# World-writable directories WITHOUT the sticky bit
find / -xdev -type d -perm -0002 ! -perm -1000 2>/dev/null

For each SUID program you do not recognise, look it up — and check GTFOBins, which documents how common binaries can be abused when misconfigured.

Check your understanding

What permissions does chmod 750 deploy.sh give?

Owner: read, write, execute (7). Group: read and execute (5). Others: nothing (0) — rwxr-x---.

Why is a world-writable directory without the sticky bit dangerous?

Any user can delete or replace other users’ files in it — for example swapping a script that someone else, or root, later runs.

Why do attackers search for SUID files?

SUID programs run with their owner’s rights, usually root. A misconfigured or vulnerable one can give a normal user a root shell.

Key takeaways

Know where configuration, logs and temporary files live.
Least privilege starts with file permissions: give only what is needed.
Keep a baseline of SUID and world-writable files and review changes.