adminLinux Permissions ACL and Umask Checklist for RHCSA
Permissions decide who can read, write or execute files. RHCSA practice should go beyond chmod numbers and include ownership, groups, ACLs and default permissions through umask.
Core principle
Access is the result of owner, group, mode bits, ACL rules and process identity. To fix permissions correctly, identify who needs access and why.
Checklist
- Inspect ownership and permission bits.
- Change owner with chown.
- Change group with chgrp.
- Use symbolic chmod safely.
- Use numeric chmod only when clear.
- Check default umask.
- Set ACL for a specific user or group.
- Check ACL inheritance if needed.
- Test access as the target user.
- Document permission intent.
Reusable lesson
This applies to websites, shared folders, service accounts, logs, backups, upload directories and deployment workflows.
When to Use This Checklist
Use this checklist when practicing Linux permissions, ACLs and default permission behavior for RHCSA and real server operations.
Required Tools
Linux VM, test users, test groups, chmod, chown, getfacl, setfacl, umask
Before You Start
Do not use chmod 777 as a shortcut. Fix the real owner, group or ACL requirement.
Structured Checklist Steps
- Inspect permissions.
- Change owner.
- Change group.
- Apply symbolic chmod.
- Apply numeric chmod if needed.
- Check umask.
- Set ACL.
- Check ACL.
- Test as target user.
- Document intent.
Verification Steps
- Correct user can access the file.
- Unauthorized users are blocked.
- ACL rules are visible.
- Default permissions are understood.
- No world-writable shortcut is used.
Rollback Plan
If permission changes break access, restore the previous owner, group or ACL from your notes and retest with the target user.
Common Mistakes
- Using 777 to fix everything.
- Ignoring process user.
- Forgetting group membership.
- Setting ACL but not testing access.
- Misunderstanding execute permission on directories.
Related Commands
ls -la file.txt
sudo chown user1 file.txt
sudo chgrp webops file.txt
chmod u+rw,g+r,o-rwx file.txt
umask
setfacl -m u:user2:r file.txt
getfacl file.txt
sudo -u user2 cat file.txt