5.1 File Permissions and Ownership

Kali Linux Certified Professional KLCP

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 How to Use This Guide & Study Strategy 1.3 PEN-103 Syllabus & Study Path

2 About Kali Linux

2.1 A Bit of History: From BackTrack to Kali 2.2 Kali's Relationship with Debian 2.3 Purpose and Use Cases 2.4 Main Features and Design Policies

3 Getting Started with Kali Linux

3.1 Downloading and Verifying a Kali ISO 3.2 Booting Kali in Live Mode 3.3 Installation Options Overview 3.4 Troubleshooting Installations

4 Linux Fundamentals

4.1 What Linux Is and What It Does 4.2 The Command Line 4.3 The Filesystem Hierarchy Standard 4.4 Useful Commands: Files, Search, Environment

5 Permissions and Process Management

5.1 File Permissions and Ownership 5.2 Managing Processes 5.3 Shells, Variables, and the Environment

6 Installing Kali Linux

6.1 Minimal Installation Requirements 6.2 Step-by-Step Installation on a Hard Drive 6.3 Unattended Installations with Preseeding 6.4 ARM Installations

7 Configuring the Network, Users, and SSH

7.1 Configuring the Network 7.2 Managing Unix Users and Groups 7.3 Configuring SSH

8 Configuring Services

8.1 Apache Web Server 8.2 PostgreSQL Database 8.3 Managing Services with systemd

9 Helping Yourself and Getting Help

9.1 Documentation Sources 9.2 Kali Linux Communities 9.3 Filing Good Bug Reports

10 Security Policy and Network Services

10.1 Defining a Security Policy 10.2 Possible Security Measures 10.3 Securing Network Services

11 Firewalling and Monitoring

11.1 Netfilter and iptables Behavior 11.2 Writing iptables Rules and NAT 11.3 Monitoring and Logging

12 Debian Package Management: APT

12.1 Introduction to APT 12.2 The sources.list File 12.3 Kali Repositories 12.4 Basic Package Interaction with apt

13 dpkg and Advanced Package Management

13.1 dpkg Fundamentals 13.2 Inspecting .deb Files and Package State 13.3 Maintainer Scripts and Conffiles 13.4 APT Pinning and Package Authenticity

14 Advanced Usage

14.1 Modifying and Rebuilding Kali Packages 14.2 Recompiling the Kernel 14.3 Building Custom Kali Live ISO Images 14.4 USB Persistence with LUKS Encryption

15 Kali Linux in the Enterprise

15.1 Network Installation with PXE Boot 15.2 Configuration Management with SaltStack 15.3 Metapackages and Custom Repositories 15.4 Configuration Packages and Forking

16 Introduction to Security Assessments

16.1 Kali Linux in an Assessment 16.2 Types of Assessments 16.3 Types of Attacks 16.4 Formalization and the Road Ahead

5.1 File Permissions and Ownership

Key Takeaways Explain This Topic AI

Every file has three permission triplets — user (owner), group, and other — where r=4, w=2, x=1, so chmod 755 means rwxr-xr-x.

Symbolic chmod uses u/g/o/a with +, -, = operators: chmod u+x adds execute for the owner without touching other bits.

umask 022 (Kali default for regular users) yields 644 files and 755 directories; umask 077 makes everything private to the owner.

setuid (4xxx) runs a program with the file owner's privileges (e.g. /usr/bin/passwd), setgid on a directory (2xxx) forces new files to inherit the directory's group, and the sticky bit (1xxx) on /tmp lets only a file's owner delete it.

Only root can chown a file to another user; chgrp or chown :group changes group ownership, and find -perm -4000 locates setuid binaries.

Last updated: July 2026

Understanding the Permission Model

Every file and directory on a Kali system carries ownership (a user and a group) and a permission set of nine bits arranged as three triplets: one for the owning user (u) , one for the owning group (g) , and one for other (o) — everyone else. Each triplet holds read (r) , write (w) , and execute (x) . Run ls -l and you see them directly: -rwxr-xr-- 1 kali analysts 4096 Jul 26 10:00 scan.sh

Here the owner kali has rwx , group analysts has r-x , and others have r-- . The leading character is the file type: - for a regular file, d for a directory, l for a symlink.

Permissions mean slightly different things on directories , which the KLCP exam loves to probe:

• Bit On a file On a directory
• r (4) Read the contents List filenames ( ls )
• w (2) Modify the contents Create, delete, rename entries
• x (1) Execute as a program Enter it ( cd ) and access files by name

A classic trap: to open a file inside a directory you need execute on the directory plus read on the file. Read on a directory without execute lets you list names but not open anything.

Octal Notation with chmod

Each triplet sums to one octal digit: r=4, w=2, x=1. So rwxr-xr-x = 4+2+1, 4+0+1, 4+0+1 = 755 . The chmod command applies these: chmod 755 scan.sh # rwxr-xr-x — owner full, everyone read+execute

• chmod 600 id_rsa # rw------- — private key, owner only
• chmod 644 notes.txt # rw-r--r-- — typical document
• chmod 700 scripts/ # drwx------ — private directory

Memorize the common ones: 755 for executables and public directories, 644 for regular files, 600 for secrets, 700 for private directories. Use chmod -R to apply recursively, but be careful — a blanket chmod -R 755 on a mixed tree makes every data file executable. A safer pattern combines find with chmod : find dir -type d -exec chmod 755 {} + and find dir -type f -exec chmod 644 {} + .

Symbolic Notation

Symbolic mode modifies specific classes without recomputing octal: chmod [ugoa][+-=][rwx] . chmod u+x scan.sh # add execute for the owner

• chmod go-w report.txt # remove write from group and other
• chmod a=r public.txt # set everyone to exactly read-only
• chmod g+s teamdir/ # add the setgid bit (see below)

u , g , o , a select user, group, other, or all; + adds, - removes, = sets exactly. chmod u+x is the single most common form — it makes a script executable while leaving every other bit untouched.

Ownership: chown and chgrp

chown changes the owning user, chgrp the owning group. Only root can give a file away to another user (this prevents quota evasion and planted setuid traps); a regular user can only change the group to one they belong to. sudo chown kali scan.sh # change owner

• sudo chown kali:analysts scan.sh # owner and group at once
• sudo chown :analysts scan.sh # group only (chgrp equivalent)
• chgrp analysts scan.sh # allowed if you are in analysts
• sudo chown -R www-data:www-data /var/www/html
• Default Permissions: umask

The umask subtracts bits from the base defaults (666 for files, 777 for directories — note files never get execute by default). The classic Kali/Debian default umask for a regular user is 022 , producing 644 files and 755 directories — and 022 is the value the exam expects. (On current Kali, which tracks Debian 13 and later, pam_umask with user-private groups gives the default kali account a mask of 002 , producing 664 files and 775 directories.) A hardened 077 umask produces 600 files and 700 directories — fully private. Check and set it with: umask # shows the active mask (0022 classically; 0002 for the kali user on current Kali)

umask 077 # new files become private; set in ~/.zshrc to persist

The umask is a mask, not a chmod: a program that asks for 644 with umask 022 still gets 644, because only the requested bits that survive the mask are applied.

The Special Bits: setuid, setgid, Sticky

A fourth octal digit prefixes the three you know: setuid=4, setgid=2, sticky=1.

• Bit Octal Symbol Effect
• setuid 4000 s in user x position Program runs with the file owner's privileges
• setgid (file) 2000 s in group x position Program runs with the file group's privileges
• setgid (directory) 2000 s in group x position New files inherit the directory's group
• sticky 1000 t in other x position In a directory, only a file's owner (or root) can delete/rename it

The canonical setuid example is /usr/bin/passwd : it is -rwsr-xr-x owned by root so any user can modify the root-owned /etc/shadow through it. From a security-audit perspective you should know how to hunt these down: find / -perm -4000 -type f 2>/dev/null # all setuid binaries

find / -perm -2000 -type f 2>/dev/null # all setgid binaries

Setgid on a directory is the team-collaboration pattern: chmod 2770 /shared plus chgrp analysts /shared means every file created inside belongs to group analysts automatically — no one forgets to chgrp . The sticky bit is why /tmp shows drwxrwxrwt (mode 1777): everyone can create files, but you cannot delete someone else's. Without it, any user could wipe another user's temp files. Set them with chmod 4755 , chmod 2755 , chmod 1777 , or symbolically with u+s , g+s , +t . When the underlying execute bit is absent, ls shows a capital S or T — a visual flag that the special bit is set but does nothing.