🔧 Tools & Platforms
Linux Security Model
Linux security is built on a straightforward but powerful model: every file has an owner and a group, and every process runs as a specific user. Bresnahan and Blum cover the three pillars of Linux security: user and group management, file ownership, and permission control. The system enforces access through three permission types (read, write, execute) applied to three scopes (owner, group, others), creating a matrix that controls who can access what. Combined with the root superuser concept and sudo for privilege escalation, this model provides the security architecture underlying every Linux server, container, and cloud instance. Understanding it is non-negotiable for anyone managing Linux systems.
2
Minutes
2
Concepts
+45
XP
1
How It Works
- Users and groups — Every user has a UID (user ID) and belongs to a primary group (GID) plus optional supplementary groups. User info lives in
/etc/passwd, passwords in/etc/shadow, groups in/etc/group.
useradd -m -s /bin/bash username— create user with home directoryusermod -aG docker username— add user to supplementary groupuserdel -r username— delete user and home directorygroupadd devops— create a groupid username— show UID, GID, and group memberships
- File ownership — Every file has an owner (user) and a group.
chownchanges ownership:
chown user:group file— change both owner and groupchown -R user:group directory/— recursive ownership changechgrp group file— change group only
New files inherit the creating user's UID and primary GID.
- Permission model (rwx) — Three permissions applied to three scopes:
| Permission | File meaning | Directory meaning | |
|---|---|---|---|
| --- | --- | --- | |
| r (read, 4) | View contents | List contents | |
| w (write, 2) | Modify contents | Create/delete files in dir | |
| x (execute, 1) | Run as program | Enter (cd into) directory |
Displayed as: -rwxr-xr-- = owner rwx, group r-x, others r--
- chmod — changing permissions — Two notations:
- Symbolic:
chmod u+x script.sh,chmod go-w file.txt,chmod a+r public.html - Octal:
chmod 755 script.sh(rwxr-xr-x),chmod 644 config.txt(rw-r--r--),chmod 600 secret.key(rw-------)
Common patterns: 755 for executables/directories, 644 for regular files, 600 for sensitive files, 700 for private directories.
- Sudo and privilege escalation — Root (UID 0) bypasses all permission checks.
sudoallows specific users to execute commands as root (or another user) based on rules in/etc/sudoers. Best practice: never log in as root; always use sudo for administrative commands.sudo -lshows what the current user is allowed to run.