# Demonstration: A Real Permission Denial, and the Real Fix

## OBSERVE

A file is owned by root with permissions `600` (owner read/write only):

```
$ stat -c '%a %U' data.txt
600 root
```

## HYPOTHESIS

Predict: can a different, non-root user read this file?

## INSPECT

```
$ su - labuser -c "cat data.txt"
cat: data.txt: Permission denied
```

Confirmed — `600` grants nothing to group or other, so `labuser` (neither the owner nor root)
is correctly denied.

## CHANGE

Grant read access to everyone, while keeping write access limited to the owner:

```
$ chmod 644 data.txt
$ stat -c '%a' data.txt
644
```

## VERIFY

```
$ su - labuser -c "cat data.txt"
sensitive
```

The exact same command that failed before now succeeds — the permission bits, not the file's
actual content, were the only thing that changed.

## Instructor Notes

**Demo goal:** Show a permission denial as a real, reproducible fact (not just a described
error message) and the exact minimal fix, not an overcorrection like `chmod 777`.

**Approximate timing:** 8 minutes live.

**Common mistake to watch for:** students reaching for `chmod 777` "to make the error go away"
— explicitly name why that's wrong (it also grants WRITE to everyone, not just the read access
actually needed) and connect it back to least privilege.