5.1 File Permissions and Ownership

Understanding the Permission Model

Every file and directory on a Kali system carries ownership (a user and a group) and a permission set of nine bits arranged as three triplets: one for the owning user (u), one for the owning group (g), and one for other (o) — everyone else. Each triplet holds read (r), write (w), and execute (x). Run ls -l and you see them directly:

-rwxr-xr-- 1 kali analysts 4096 Jul 26 10:00 scan.sh

Here the owner kali has rwx, group analysts has r-x, and others have r--. The leading character is the file type: - for a regular file, d for a directory, l for a symlink.

Permissions mean slightly different things on directories, which the KLCP exam loves to probe:

A classic trap: to open a file inside a directory you need execute on the directory plus read on the file. Read on a directory without execute lets you list names but not open anything.

Octal Notation with chmod

Each triplet sums to one octal digit: r=4, w=2, x=1. So rwxr-xr-x = 4+2+1, 4+0+1, 4+0+1 = 755. The chmod command applies these:

chmod 755 scan.sh        # rwxr-xr-x — owner full, everyone read+execute
chmod 600 id_rsa         # rw------- — private key, owner only
chmod 644 notes.txt      # rw-r--r-- — typical document
chmod 700 scripts/       # drwx------ — private directory

Memorize the common ones: 755 for executables and public directories, 644 for regular files, 600 for secrets, 700 for private directories. Use chmod -R to apply recursively, but be careful — a blanket chmod -R 755 on a mixed tree makes every data file executable. A safer pattern combines find with chmod: find dir -type d -exec chmod 755 {} + and find dir -type f -exec chmod 644 {} +.

Symbolic Notation

Symbolic mode modifies specific classes without recomputing octal: chmod [ugoa][+-=][rwx].

chmod u+x scan.sh        # add execute for the owner
chmod go-w report.txt    # remove write from group and other
chmod a=r public.txt     # set everyone to exactly read-only
chmod g+s teamdir/       # add the setgid bit (see below)

u, g, o, a select user, group, other, or all; + adds, - removes, = sets exactly. chmod u+x is the single most common form — it makes a script executable while leaving every other bit untouched.

Ownership: chown and chgrp

chown changes the owning user, chgrp the owning group. Only root can give a file away to another user (this prevents quota evasion and planted setuid traps); a regular user can only change the group to one they belong to.

sudo chown kali scan.sh          # change owner
sudo chown kali:analysts scan.sh # owner and group at once
sudo chown :analysts scan.sh     # group only (chgrp equivalent)
chgrp analysts scan.sh           # allowed if you are in analysts
sudo chown -R www-data:www-data /var/www/html

Default Permissions: umask

The umask subtracts bits from the base defaults (666 for files, 777 for directories — note files never get execute by default). The classic Kali/Debian default umask for a regular user is 022, producing 644 files and 755 directories — and 022 is the value the exam expects. (On current Kali, which tracks Debian 13 and later, pam_umask with user-private groups gives the default kali account a mask of 002, producing 664 files and 775 directories.) A hardened 077 umask produces 600 files and 700 directories — fully private. Check and set it with:

umask          # shows the active mask (0022 classically; 0002 for the kali user on current Kali)
umask 077      # new files become private; set in ~/.zshrc to persist

The umask is a mask, not a chmod: a program that asks for 644 with umask 022 still gets 644, because only the requested bits that survive the mask are applied.

The Special Bits: setuid, setgid, Sticky

A fourth octal digit prefixes the three you know: setuid=4, setgid=2, sticky=1.

The canonical setuid example is /usr/bin/passwd: it is -rwsr-xr-x owned by root so any user can modify the root-owned /etc/shadow through it. From a security-audit perspective you should know how to hunt these down:

find / -perm -4000 -type f 2>/dev/null   # all setuid binaries
find / -perm -2000 -type f 2>/dev/null   # all setgid binaries

Setgid on a directory is the team-collaboration pattern: chmod 2770 /shared plus chgrp analysts /shared means every file created inside belongs to group analysts automatically — no one forgets to chgrp. The sticky bit is why /tmp shows drwxrwxrwt (mode 1777): everyone can create files, but you cannot delete someone else's. Without it, any user could wipe another user's temp files. Set them with chmod 4755, chmod 2755, chmod 1777, or symbolically with u+s, g+s, +t. When the underlying execute bit is absent, ls shows a capital S or T — a visual flag that the special bit is set but does nothing.