12.3 Processes, Permissions & File Systems

Navigation commands get you to files; Windows services and shells get work done on a host. This section ties the operating-systems domain together with three concepts that appear across cyber aptitude items: how execution is organized (processes and threads), how Linux controls access (rwx permissions and octal modes), and how disks store data at a high level (NTFS vs ext4).

Processes vs Threads

A process is an instance of a program in execution. When you launch a browser, a terminal, or a background service, the operating system creates a process with:

• Its own process ID (PID)
• Its own virtual address space (memory isolation from other processes, in normal user-mode cases)
• Handles/resources tracked by the OS (open files, network sockets, and so on)
• At least one thread of execution

A thread is the OS's basic unit of CPU scheduling inside a process. Multiple threads in the same process share the process's memory and resources, which makes communication cheap — and also makes bugs and race conditions more dangerous.

Comparison for rapid recall:

Why cyber cares: malware may spawn extra processes to hide, or inject/create threads inside a trusted process to blend in. Performance issues may be "one process, many busy threads." On the Cyber Test, the clean distinction is enough: processes isolate programs; threads are concurrent workers inside one program.

If section 12.1's ps/top showed you which processes exist, this section explains what those listings represent.

Linux Permissions: rwx and the Three Classes

Linux (and Unix-like systems) attach an access mode to each file and directory. The classic model uses three permission bits for each of three classes:

The three bits are:

A long listing (ls -l) shows a string like -rwxr-xr--. Ignoring the file-type character at the front, the next nine characters are owner/group/others: rwx r-x r--.

Directories need execute permission to be entered. This surprises newcomers: having r without x on a directory may let you see names in some cases depending on context, but you generally cannot traverse into the directory without x. For files, x means "runnable."

Octal Permission Notation

Administrators often write modes as three octal digits — one digit per class (owner, group, others). Each digit is the sum of:

Examples:

Whole-mode examples:

• 755 → owner rwx, group r-x, others r-x — common for executables/scripts meant to be run by others without being writable by them
• 644 → owner rw-, group r--, others r-- — common for ordinary readable files
• 600 → owner rw-, group/others none — private files (keys, credential material)
• 700 → owner full, nobody else — private directories or scripts
• 777 → everyone everything — almost always a security smell on multi-user systems

Special bits (setuid/setgid/sticky) exist beyond the basic three digits; aptitude items usually stay with base rwx/octal. If you see a leading extra digit in advanced material, treat it as advanced — master 755/644/600 first.

Security takeaway: least privilege means granting only the classes and bits required. World-writable configs (666/777) and executable secrets are classic findings.

File Systems at a High Level: NTFS vs ext4

A file system defines how an operating system organizes, names, and retrieves data on storage. You do not need on-disk layout diagrams for the Cyber Test, but you should recognize the native "home" filesystems of Windows and Linux.

NTFS (Windows)

NTFS (New Technology File System) is the standard modern filesystem for Windows system volumes. High-level traits candidates should know:

• Supports permissions/ACLs, encryption features (in supported configurations), compression, and large files/volumes
• Integrates with Windows security identifiers and access control models
• Journals metadata to improve recoverability after crashes (conceptual point: it is more resilient than older FAT-style systems)

When people say "Windows drive formatted for a normal PC install," they usually mean NTFS for the main OS volume.

ext4 (Linux)

ext4 is a widely used Linux filesystem (successor in the ext family after ext2/ext3). High-level traits:

• Common default for many Linux distributions' root and data partitions
• Supports journaling, large files, and extents for efficient storage of large contiguous data
• Works naturally with Linux user/group permission models (the rwx world you just studied)

Contrast Without Overfitting

Cross-platform nuance (useful but keep light): Linux can often read NTFS with drivers/tools; Windows does not natively treat ext4 as a first-class citizen without extra software. Removable media may still use FAT32/exFAT for compatibility — those are different filesystems optimized for interchange, not the primary OS volumes discussed here.

Connecting the Three Topics

Put it in one workflow story:

1. A process (maybe with multiple threads) runs a service that reads a config file
2. The file lives on ext4 (Linux) or NTFS (Windows)
3. On Linux, octal/rwx permissions decide whether that process's user can read or modify the file

If permissions are wrong, the process fails closed (access denied) or fails open (anyone can read secrets). If you confuse threads with processes, you misread how isolation works. If you confuse NTFS with ext4, you misread which OS security model applies.

Study Drill

Before moving on, ensure you can:

• Define process vs thread in one sentence each
• Convert between a symbolic mode like rw-r----- and octal 640
• Explain why x on a directory matters for cd
• Name NTFS as Windows-typical and ext4 as Linux-typical

Those four checks cover the majority of processes/permissions/filesystem questions in this domain.