Linux permissions for a deployed application

File permissions should match the service identity and operation. Making a secret world-readable to fix one error creates a larger one.

Decode an owner-only mode

The engineering foundations lab calculates permission bits without changing a file.

from engineering_cases import permissions_case

result = permissions_case()
assert result["octal"] == "0o600"
assert result["owner_read"] is True
assert result["owner_write"] is True
assert result["group_access"] is False
assert result["other_access"] is False
assert result["chmod_executed"] is False

Understand user, group and other; read, write and execute; ownership; directories; and process identity. Code may be readable but not writable by the running service. A secret file often needs owner-only read, while a log directory needs scoped write.

Inspect effective identity and every directory in the path. Avoid running as root. Use deployment tooling to set owner/mode reproducibly and test both required access and denied access. ACLs, containers and mounted secrets add layers that must be checked in the actual environment.

The FDE for Freshers course connects Linux permissions to containers and cloud deployment.

Exercise

In a disposable directory, design modes for executable code, read-only config and writable logs. Verify access as a non-privileged service user and document cleanup.

Continue learning

This article is part of the FDE engineering foundations sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Resolve a Git conflict by understanding both changes.
• Continue with Environment variables: separate configuration and secrets.

Reference: GNU Coreutils file-permission documentation.