ADVERTISEMENT
Responsive Ad Unit • Systems Architecture & Low-Level Engineering

Security & Access Control

Security in UNIX/Linux systems protects users, processes, files, and system resources from unauthorized access and modification. The operating system enforces security using user identities, group identities, permissions, ownership, and access control mechanisms.

Learning Objectives

  • Understand UNIX/Linux security concepts.
  • Learn authentication and authorization.
  • Study users, groups, and ownership.
  • Understand permission-based access control.
  • Prepare for advanced security mechanisms.

1. What is System Security?

System security consists of mechanisms that protect operating system resources against unauthorized access, modification, disclosure, or destruction. UNIX/Linux systems implement security through identities, permissions, ownership, and controlled resource access.

2. Security Principles

Principle Description
Authentication Verify the identity of a user or process.
Authorization Determine permitted operations after authentication.
Least Privilege Grant only the permissions required for a task.
Accountability Associate actions with authenticated identities.
Resource Protection Restrict unauthorized access to system resources.

3. Authentication

Authentication verifies the identity of a user before allowing access to system resources. Common authentication methods include passwords, cryptographic keys, and external authentication services.

4. Authorization

Authorization determines which operations an authenticated user or process is permitted to perform. Permissions, ownership, and access control policies are used to enforce authorization decisions.

5. Users and Groups

Entity Purpose
User Represents an individual account.
Primary Group Default group assigned to the user.
Supplementary Groups Additional group memberships.
Root User Administrative account with elevated privileges.

6. Security Workflow

User Login ↓ Authentication ↓ Identity Verified ↓ Authorization ↓ Permission Check ↓ Access Granted or Denied

7. Security Components

Component Role
User ID (UID) Identifies a user account.
Group ID (GID) Identifies a group.
Ownership Associates files with users and groups.
Permissions Control access to resources.
Access Control Determines permitted operations.

8. Security Objectives

UNIX/Linux security mechanisms aim to protect system resources, ensure controlled access, maintain accountability, and preserve system integrity during normal operation.

9. Interview Questions

  1. What is authentication?
  2. How does authorization differ from authentication?
  3. What is the purpose of a User ID?
  4. What is a Group ID?
  5. What is the principle of least privilege?
  6. Why are user groups used?
  7. What responsibilities does the root user have?
  8. Why is accountability important in system security?
  9. What role does ownership play in access control?
  10. How are permissions enforced in UNIX/Linux?

10. File Ownership

Every file and directory in a UNIX/Linux system has an owner (User ID) and an associated group (Group ID). Ownership determines which users may modify permissions, change ownership, or perform privileged operations on the file.

11. File Permissions

UNIX/Linux permissions define which operations can be performed on files and directories. Permissions are evaluated separately for the file owner, members of the associated group, and all other users.

12. Permission Bits

Permission Symbol Meaning
Read r Read file contents or list directory contents.
Write w Modify a file or create/remove directory entries (subject to directory permissions).
Execute x Execute a program or traverse a directory.

13. Permission Classes

Class Symbol Description
Owner u Permissions for the file owner.
Group g Permissions for users in the associated group.
Others o Permissions for all remaining users.
All a Represents owner, group, and others together.

14. Numeric Permission Values

Permission Binary Octal Value
Read 100 4
Write 010 2
Execute 001 1
Read + Write 110 6
Read + Execute 101 5
Read + Write + Execute 111 7

15. chmod Utility

The chmod utility changes the permission bits of files and directories. Permissions may be specified using symbolic notation or octal (numeric) notation.

16. chown Utility

The chown utility changes the owner and, optionally, the group associated with a file or directory. Changing file ownership generally requires appropriate privileges.

17. Practical POSIX Example

#include int main(void) { chmod("example.txt", S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); return 0; }

The POSIX chmod() function modifies file permission bits programmatically.

18. Linux Security Commands

Command Description
ls -l Display ownership and permission information.
chmod 755 file Assign rwxr-xr-x permissions.
chmod u+x file Add execute permission for the owner.
chown user file Change the file owner.
chown user:group file Change both owner and group.
chgrp group file Change the associated group.

19. Interview Questions

  1. What information does file ownership contain?
  2. What are the three basic UNIX permission bits?
  3. How are permissions evaluated?
  4. What is the difference between symbolic and numeric permissions?
  5. What does permission value 755 represent?
  6. When is chmod used?
  7. When is chown used?
  8. What is the purpose of chgrp?
  9. Who is normally allowed to change file ownership?
  10. How can file permissions be displayed?

20. umask

The umask specifies which permission bits are cleared when new files and directories are created. It defines the default permissions assigned during file creation by masking selected permission bits.

21. Special Permissions

UNIX/Linux provides three special permission bits that extend the standard read, write, and execute permission model. These are Set User ID (SUID), Set Group ID (SGID), and the Sticky Bit.

22. Set User ID (SUID)

When the SUID bit is set on an executable file, the program executes with the effective User ID of the file owner instead of the user who started the program.

Permission Symbol Numeric Value
SUID s 4000

23. Set Group ID (SGID)

When the SGID bit is set on an executable file, the program executes with the effective Group ID of the file's group. When SGID is applied to a directory, newly created files normally inherit the directory's group ownership.

Permission Symbol Numeric Value
SGID s 2000

24. Sticky Bit

When the Sticky Bit is set on a directory, users can remove or rename only files that they own (or those permitted by system privileges), even if the directory is writable by others.

Permission Symbol Numeric Value
Sticky Bit t 1000

25. Access Control Lists (ACLs)

Access Control Lists (ACLs) extend the traditional UNIX permission model by allowing permissions to be assigned to specific users and groups beyond the standard owner, group, and others categories. ACL support depends on the filesystem and operating system configuration.

26. POSIX Security APIs

Function Purpose
chmod() Modify permission bits.
umask() Set the file creation mode mask.
access() Test accessibility using the calling process's real IDs.
stat() Retrieve file metadata including permission bits.
fstat() Retrieve metadata for an open file descriptor.

27. Practical POSIX Example

#include int main(void) { umask(022); return 0; }

The POSIX umask() function establishes the process file mode creation mask used for subsequently created files and directories.

28. Linux Security Commands

Command Description
umask Display the current file creation mask.
umask 022 Set the default permission mask.
getfacl file Display file Access Control Lists.
setfacl -m u:user:rwx file Add or modify a user ACL entry.
ls -l Display special permission bits.

29. Advanced Interview Questions

  1. What is the purpose of umask?
  2. How does SUID affect program execution?
  3. What happens when SGID is applied to a directory?
  4. What problem does the Sticky Bit solve?
  5. Why are ACLs used?
  6. How does access() differ from opening a file?
  7. Which function retrieves file permission information?
  8. What does umask(022) accomplish?
  9. What are the numeric values of SUID, SGID, and Sticky Bit?
  10. When should ACLs be preferred over standard permissions?

30. Security Best Practices

  • Follow the principle of least privilege.
  • Assign only the permissions required for each task.
  • Review file ownership and permissions regularly.
  • Avoid granting write permission unnecessarily.
  • Use groups to simplify permission management.
  • Protect sensitive files from unauthorized access.
  • Audit permission changes periodically.
  • Use stronger access control mechanisms when standard permissions are insufficient.

31. Common Security Mistakes

Mistake Possible Consequence
Using overly permissive file modes Unauthorized users may gain access.
Assigning incorrect ownership Legitimate users may lose required access.
Ignoring file creation masks New files may receive broader permissions than intended.
Improper use of SUID programs Programs may execute with elevated privileges unnecessarily.
Neglecting regular permission reviews Outdated access rights may remain in place.
Relying only on standard permissions More granular access requirements may not be met.

32. Security Limitations

Limitation Description
Standard Permission Model Provides only owner, group, and others permission classes.
Privilege Misconfiguration Incorrect permissions can weaken security.
Filesystem Dependency Advanced security features depend on filesystem support.
Administrative Errors Incorrect configuration can expose resources.
Application Security Correct file permissions alone do not eliminate software vulnerabilities.

33. APUE / POSIX vs Linux Security Features

Feature Category
chmod() POSIX / APUE
umask() POSIX / APUE
access() POSIX / APUE
stat() POSIX / APUE
Traditional Permission Model POSIX / APUE
ACL Utilities (getfacl, setfacl) Linux Extension
Linux Capabilities Linux Extension
SELinux Linux Extension

34. Module Summary

This module introduced UNIX/Linux security concepts including authentication, authorization, user and group identities, ownership, permission bits, file creation masks, special permissions, Access Control Lists (ACLs), POSIX security APIs, and common security utilities. The module also distinguished standard POSIX security mechanisms from Linux-specific security extensions.

Next Module

The Security & Access Control module is now complete. Continue to: Linux Kernel Interfaces

Next → Linux Kernel Interfaces
Knowledge Check

Concept Mastery Assessment — Module 69

Verify your conceptual understanding with 12 targeted technical assessment questions. Instant feedback and explanations are provided for every choice.

Question 1 of 12
What is the primary architectural purpose of Security, Linux Capabilities & Access Control in operating systems?
Explanation
Security, Linux Capabilities & Access Control is designed to manage dropping root privileges, linux capabilities (cap_net_bind_service, cap_sys_admin), posix access control lists (acls), and secure programming practices. within the operating system architecture.
Question 2 of 12
Which system interface or data structure is centrally associated with Security, Linux Capabilities & Access Control?
Explanation
Under POSIX and Linux, Security, Linux Capabilities & Access Control operates through standardized system calls and kernel control structures.
Question 3 of 12
What safety or concurrency constraint must developers consider when implementing Security, Linux Capabilities & Access Control?
Explanation
Proper synchronization, avoidance of race conditions, and handling reentrant execution are critical when working with Security, Linux Capabilities & Access Control.
Question 4 of 12
When a system call related to Security, Linux Capabilities & Access Control fails in C, how does the POSIX runtime conventionally report the failure?
Explanation
Standard POSIX system calls return -1 or NULL on error, assigning an error integer (e.g. EINVAL, EPERM, EAGAIN) to the thread-local errno variable.
Question 5 of 12
What is the primary performance tradeoff associated with Security, Linux Capabilities & Access Control?
Explanation
Operations involving Security, Linux Capabilities & Access Control balance performance against kernel transition, memory bandwidth, and cache locality tradeoffs.
Question 6 of 12
What security principle governs access to resources in Security, Linux Capabilities & Access Control?
Explanation
The kernel validates credentials, effective permissions, and Linux capabilities before granting access to protected operations.
Question 7 of 12
How does execution of Security, Linux Capabilities & Access Control transition between User Space and Kernel Space?
Explanation
User space transitions to kernel mode securely via software traps or SYSCALL instructions that switch processor rings to Ring 0.
Question 8 of 12
What happens to resources allocated by Security, Linux Capabilities & Access Control when the owning process terminates?
Explanation
Process resources (open fds, memory maps) are automatically reclaimed by the kernel on termination, while kernel-persistent objects survive.
Question 9 of 12
In production Linux server environments, how is Security, Linux Capabilities & Access Control optimized for high throughput?
Explanation
Linux optimizes throughput via zero-copy data paths, asynchronous kernel events, and scalable concurrency primitives.
Question 10 of 12
What standard governs the portability of Security, Linux Capabilities & Access Control across Unix, Linux, and macOS platforms?
Explanation
IEEE POSIX standards define consistent APIs across Unix-like platforms ensuring portable source code execution.
Question 11 of 12
Which command-line diagnostic tool is most effective for inspecting and troubleshooting Security, Linux Capabilities & Access Control at runtime?
Explanation
Utilities like strace, lsof, and the /proc filesystem provide direct visibility into kernel interactions and resource status.
Question 12 of 12
What is a critical production best practice when developing systems software involving Security, Linux Capabilities & Access Control?
Explanation
Defensive programming requires explicit error checking on all system operations, proper resource cleanup, and avoiding memory corruption.
0 / 12 (0%)
Great job! Review the concepts above and proceed when ready.
ADVERTISEMENT
Responsive Ad Unit • Technical Courses & Certifications