1. 

þ UNIX file permissions provide read, write, and execute permissions.

2. 

þ Using standard UNIX file permissions, you can provide read, write, and execute permissions for three user classes (file owner, group, and other users), whereas ACLs take security a step further by enabling you to define file permissions for each user class. For example, let's say you want the sales user group to read a particular file; however, you want only the sales manager— part of the sales group—also to have permission to make changes to that file. With UNIX file permissions, you're limited to making the file either read-only or read-write for the sales group. On the other hand, by using ACLs, you can make the file read-only for the sales group, with the exception of read-write for the sales manager.

3. 

þ UNIX file permissions provide permissions for three user classes (file owner, group, and other users).

4. 

þ The Read permission is indicated with the symbol r. This permission allows users to open and read a file and list files in a directory.

5. 

þ The Write permission is indicated with the symbol w. This permission allows users to open, read, delete, and modify the contents of a file, and list and add files and links in a directory or remove them.

6. 

þ The Execute permission is indicated with the symbol x. This permission allows users to execute a file (program or shell script) in a directory.

7. 

þ The Deny permission is the one indicated with the symbol -.This permission denies read, write, and execute access.

8. 

þ B. The chown command is used to change user ownership of a file.

ý A is wrong because ls is used to list files and some information about the files contained within a directory. C is wrong because chgrp is used to change group ownership of a file. D is wrong because chmod is used to change permissions on a file.

9. 

þ D. The chmod command is used to change permissions on a file.

ý A is wrong because ls is used to list files and some information about the files contained within a directory. B is wrong because chown is used to change user ownership of a file. C is wrong because chgrp is used to change group ownership of a file.

10. 

þ A. The ls command is used to list files and some information about the files contained within a directory.

ý B is wrong because chown is used to change user ownership of a file. C is wrong because chgrp is used to change group ownership of a file. D is wrong because chmod is used to change permissions on a file.

11. 

þ C. The chgrp command is used to change group ownership of a file.

ý A is wrong because ls is used to list files and some information about the files contained within a directory. B is wrong because chown is used to change user ownership of a file. D is wrong because chmod is used to change permissions on a file.

12. 

þ When setuid permission is set on an executable file, a process that runs this file is granted access on the basis of the owner of the file. This permission presents a security risk, as attackers can find a way to maintain the permissions that are granted to them by the setuid process, even after the process has finished executing.

13. 

þ Use the find command to locate files with setuid permissions and then view the results with the more command. First, log in with an account that has root privileges, or use the switch user (su) command to become superuser. As superuser, you'll have full privileges, which may be required to search all files. Next, search for files with setuid permissions with the find command:

find directory -user root -perm -4000 -exec ls -ldb {} \; >/tmp/findresults

View the results in /tmp/findresults using the more command, like so:

more /tmp/findresults

where findresults is the name of the file to which you wrote your find results to in the /tmp directory.

14. 

þ To disable executable stacks and enable stack message logging, you need to make changes in the /etc/system file, and then reboot the operating system to initiate the changes.

1. Log in with an account that has root privileges, or use the su command to become superuser.

2. Change directory to the /etc folder and edit the system file (/etc/system) by adding set noexec_user_stack=1.

3. While editing the /etc/system file, add set noexec_user_stack_log=1.

4. Save the changes and exit the editor.

5. Issue the command init 6 to restart the server.

15. 

þ To set an ACL on a file, use the setfacl command.

16. 

þ To verify the file has your ACL, issue the getfacl filename command. Use the setfacl command with the following syntax:

setfacl -s user::perms,group::perms,other:perms,mask:perms,acl-entry-list filename ...;

where:

• -s sets an ACL on the file. If a file already has an ACL, it is replaced. This option requires at least the user::, group::, and other:: entries.

• user::perms specifies the file owner permissions.

• group::perms specifies the group ownership permissions.

• other:perms specifies the permissions for users other than the file owner or members of the group.

• mask:perms specifies the permissions for the ACL mask. The mask indicates the maximum permissions that are allowed for users (other than the owner) and for groups.

• acl-entry-list specifies the list of one or more ACL entries to set for specific users and groups on the file or directory. You can also set default ACL entries on a directory.

• filename ... specifies one or more files or directories on which to set the ACL. Multiple filenames are separated by spaces.

17. 

þ If you should need to modify or delete ACL entries, use the setfacl (-d or -m) acl-entry-list filename... command; where:

• -d deletes the specified ACL entries.

• -m modifies the existing ACL entry.

• acl-entry-list specifies the list of one or more ACL entries to modify on the file or directory. You can also modify default ACL entries on a directory.

• filename ... specifies one or more files or directories, separated by a space.