Access Control Models and Configuring Linux Permissions
🔑This page doesn't reteach managerial controls, anti-malware, patching, or firewalls — you already have those from 1.1.1, 1.2.1, and 1.2.3. What's new is deciding who's allowed to access what, and actually configuring it.
5.2.CAP Skill
Four Access Control Models
Access control governs which subjects (users or applications) can perform which operations (access, modify, add, remove) on which objects (files or applications). Four models describe different ways of making that decision:
🗂️ Access Control Models — click each one
Role-Based Access Control
Every subject is assigned a role, and access is defined per role rather than per person. An 'accountant' role might grant access to payroll software — anyone assigned that role gets that access automatically.
5.2.C.6–7Concept
Bell-LaPadula and the Principle of Least Privilege
The Bell-LaPadula model is a MAC model often used by governments and military organizations, built on two rules:
Property
Rule
Simple Security
Subjects may not read objects above their level
Star (*) Security
Subjects may not write to objects below their level
🔑These two rules together are summarized as "write up, read down" (WURD) — a subject can write to a higher level (passing information up without being able to read what's already there) and read from a lower level (seeing less-sensitive information without leaking anything back down).
The principle of least privilege is the simpler idea underlying all of this: give every entity exactly as much access as it needs to do its job — and no more. It's the same reasoning that made privilege escalation in 2.2.2 a genuine vulnerability in the first place.
5.2.DAP Skill
Reading and Setting Linux File Permissions
Every file on a Linux system has permissions defined for three entities, in a fixed order: the owner, the group, and everyone else. Each entity gets three possible permissions, also in a fixed order: read (r), write (w), and execute (x).
rwxr-x---owner: rwx · group: r-x · others: no access
Run ls -l to see a file's current permissions. To change them, use chmod — either the numeric method (adding up values per entity) or the symbolic method (adding or removing specific permissions by letter).
🔢 chmod Numeric Method — pick a command
7 = rwx (owner)
5 = r-x (group)
0 = --- (others)
💡The numeric values follow one rule: 4 = read, 2 = write, 1 = execute — add them together for combined permissions. A 6 means read + write (4+2); a 7 means read + write + execute (4+2+1).
ExampleGuided Example — Symbolic chmod
You need to add read and execute permissions for both the group and the user owner on a file called testfile, without changing anything for other users.
Step 1 — Identify the entities
Both the user owner (u) and the group (g) need the change — combine them as ug.
One related command worth knowing: chown changes who owns a file in the first place — useful when access needs to be reassigned entirely, rather than just adjusted.