Users, Groups & Ownership

What is it?

Every file has an owning user and group. Users are defined in /etc/passwd, groups in /etc/group; a user's group memberships decide what shared resources they can reach.

Why it matters

Access control on Linux starts with identity: who owns a file and what group it belongs to is the foundation the permission bits act on.

Where you see it

`id` shows your uid/gid/groups, `ls -l` shows owner and group per file, `chown user:group file` changes ownership.

What normal looks like

A service runs as its own low-privilege user (e.g. www-data), owning only its files; humans own their /home.

What suspicious looks like

Files owned by root that a service needs to write, or a service running as root when it needn't — an ownership mismatch that breaks the app or widens risk.

How analysts investigate

When access fails, check `ls -l` for owner/group and `id` for the acting user's memberships — the mismatch is usually right there.

Common beginner mistakes

Fixing an access problem with 777 instead of correcting ownership.
Forgetting a group change needs a fresh login to take effect.

Identity before permission

  ls -l /var/www/app.conf
  -rw-r----- 1 www-data webteam 512 ...
           owner^     ^group
  id j.rai → uid=1001 gid=1001 groups=1001(j.rai),27(sudo),1050(webteam)
  j.rai is in 'webteam' → can read the group-readable file

Ownership (user + group) plus a user's group memberships decide access before the permission bits apply.

Quick check

A user cannot read a group-readable file. What do you check first?

A quick self-check — it doesn't affect your XP or progress.