Can be used for privilege escalation. Audit SUID files regularly:
find / -perm -4000 -type f -exec ls -la {} \; 2> /dev/null
umask controls the default permissions for newly created files and directories. It is a mask — It specifies which permission bits to remove from the default mode.
umask # symbolic: u=rwx,g=rx,o=rx → octal: 0022
umask -S # human-readable
umask 0022 # files: 644 (666 - 022), directories: 755 (777 - 022)
umask 0027 # files: 640 (666 - 027), directories: 750 (777 - 027)
umask 0077 # files: 600 (666 - 077), directories: 700 (777 - 077)
# 0022 — world-readable files (default on most systems)
# 0027 — group-readable, not world-readable
# 0077 — private (only owner)
# 0007 — group-writable (for shared directories)
The math: default_permissions & ~umask. For files: 0666 & ~0022 = 0644. For directories: 0777 & ~0022 = 0755. Note that most programs do not create files with execute bits set by default, Even if the umask would allow it.
Standard Unix permissions provide only three permission classes (owner, group, other). ACLs extend This model with per-user and per-group rules.
tune2fs -l /dev/sda1 | grep " Default mount options "
setfacl -m u:john:rw /path/to/file
setfacl -m g:developers:rx /path/to/file
# Set default ACL (applied to new files in directory)
setfacl -d -m u:john:rw /shared/project/
setfacl -b /path/to/file # remove all ACLs
setfacl -x u:john /path/to/file # remove specific entry
# Mask — maximum effective permissions for named users and groups
setfacl -m m::rwx /path/to/file
# Backup and restore ACLs
getfacl -R /path > acl_backup
setfacl --restore=acl_backup
ACL evaluation order:
If the process is the file owner, use owner permissions. If there is a matching named user ACL entry, use it (subject to the mask). If the process is in the owning group or a named group ACL matches, use it (subject to the mask). Otherwise, use other permissions. chown user:group file.txt
chgrp group file.txt # equivalent
chown -R user:group /var/www/html/
chown --reference=ref_file target_file
In scripts, grep returns exit code 1 when no lines match. With set -eThis terminates the Script:
# WRONG — exits script if no matches
grep " pattern " file.txt || true
if grep -q " pattern " file.txt ; then
# Fix 3: grep --fail-with-zero-context option (GNU grep 2.36+)
# WRONG — word splitting on spaces
find . -name " *.tmp " -exec rm {} \;
# Actually, -exec {} \; is safe. The real problem is piping to xargs:
find . -name " *.tmp " | xargs rm
find . -name " *.tmp " -print0 | xargs -0 rm
find . -name " *.tmp " -delete
sort is stable only when using -s (--stable). Without it, equal-sorting lines may be Reordered:
# Stable sort — preserves original order of equal elements
sed -i (in-place editing) breaks symlinks by replacing the symlink with a regular file containing The edited content. Always use sed --follow-symlinks -i or avoid -i on symlinks.
awk uses double-precision floating-point arithmetic. This can cause precision issues with monetary Calculations or exact comparisons:
# WRONG — floating-point comparison
awk ' $3 == 1.1 ' data.txt # may miss matches
# CORRECT — use a tolerance
awk ' $3 > 1.0999 && $3 < 1.1001 ' data.txt
tr reads from stdin only. To process a file, redirect input:
tr ' a-z ' ' A-Z ' & lt ; file.txt
cat file.txt | tr ' a-z ' ' A-Z '
By default, tar preserves absolute paths during extraction, which can overwrite system files. Always inspect archives before extracting:
# Strip leading path components during extraction
tar --strip-components=1 -xvf archive.tar
# Extract to a specific directory
tar --directory /tmp/extract -xvf archive.tar
A file can be executable but not readable. For scripts, this means the shell cannot read the file to Interpret it, so execution fails with “Permission denied” even though the execute bit is set. Regular compiled binaries can still be executed without read permission.
chmod 111 binary # execute-only — works for compiled binaries
chmod 111 script.sh # fails — shell needs to read the script
By default, xargs runs the command once even with empty input:
# WRONG — runs "echo" with no arguments
# CORRECT — use -r (or --no-run-if-empty)
The -h flag (human-numeric sort, handling K``M``G suffixes) is a GNU extension. It is not Available on BSD/macOS sort. On those systems, convert sizes to bytes first or use numfmt.
This topic covers the core concepts of core utilities, including underlying theory, practical implementation, and key applications.
Key concepts include:
variables, data types, and control flow functions and procedures object-oriented programming error handling and debugging modular design Understanding these concepts thoroughly is essential for both examinations and practical programming, and requires both theoretical knowledge and hands-on practice.
Core utilities are the Swiss Army knife of Linux — ls lists files like a directory reader, cp copies files like a photocopier, mv moves files like a filing clerk, rm deletes files like a shredder, and chmod changes permissions like a security manager. The power comes from combining them: ls | grep ‘.txt’ | wc -l counts text files by piping the directory listing through a filter and counting the results. Understanding the core utilities is like learning the alphabet — once you know the letters, you can write anything. The GNU extensions add extra features, but the POSIX basics are universal.
Worked examples demonstrating the application of key concepts are covered in the detailed sub-pages linked above.
Text Processing — Utilities like grep, sed, and awk build on core file operations for advanced text manipulation.Shell Basics — Core utilities are invoked from the shell; understanding shell features enhances their use.I/O Redirection — Piping core utilities together is the foundation of the Unix philosophy.File Permissions — Commands like chmod and chown are core utilities for managing file access.