jperezduerto.info
Security in depth · Unit 22 · Lesson 18 of 44
New files begin with a permission decision
Work out a new file’s permissions and identify what a default change leaves untouched.
Helpful before thisLinux privilege escalation
After this lesson you can
- Calculate masked creation permissions and separate new objects from existing ones.
One idea. One situation. One reasoned decision.
How it works
A process requests initial permissions when it creates a file. Without a default directory ACL, its creation mask removes permission bits from that request; it does not add permissions or repair existing files. With a default ACL, Linux derives initial permissions from that ACL and the requested mode instead. Review the actual output of each service, including temporary files, because an interactive user’s defaults may differ from a background worker’s.
Read the supplied record
A fictional export worker requests ordinary file permissions 0666: read/write for owner, group, and other. Its mask is 0027, and the containing directory has no default ACL.
| Class | Requested | Mask removes | Result |
|---|---|---|---|
| Owner | Read/write | Nothing | Read/write |
| Group | Read/write | Write | Read |
| Other | Read/write | All | None |
The result is 0640. Think of removing bits, not ordinary subtraction: the mask cannot add execute permission that was absent from the request.
This is an initial state. The application may subsequently change permissions or move an existing file into place. A new policy also leaves yesterday’s exports unchanged. Review creation behavior and the resulting object, not just a setting on an administrator’s interactive shell.
If the directory has a default ACL, use the inheritance rules and requested mode instead of assuming this same mask calculation applies.
The key distinction: Creation defaults and existing object permissions have separate lifecycles.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Without a default ACL, a worker requests mode 0666 and uses umask 0027. What initial mode results?
Show the answer
Correct answer: 0640: owner read/write, group read, no rights for other. The mask removes group write and all other permissions from the requested mode; it does not add execute.
Try it
- WriteWrite the owner/group/other rights resulting from the supplied creation request. Add one separate check for yesterday’s files and one for a directory with a default ACL.