{
  "id": "linux-permissions-foundations",
  "title": "Fix a Real Permission Denial",
  "category": "Linux Fundamentals",
  "isolation_type": "shared_namespace",
  "difficulty": "Easy",
  "type": "task",
  "weight": 4,
  "description": "## Fix a Real Permission Denial\n\nA second user, `labuser`, already exists on this system. A file at `/srv/perm-lab/data.txt` currently has permissions `600` (owner read/write only) — `labuser` cannot read it. Confirm the denial is real, then fix it correctly.\n\n**Your task:**\n\n1. As `labuser`, try to read `/srv/perm-lab/data.txt` and see the permission denial for yourself: `su - labuser -c \"cat /srv/perm-lab/data.txt\"`\n2. Change the file's permissions so it's readable by everyone but still only writable by its owner (this is exactly what `644` means)\n3. Confirm `labuser` can now read it",
  "hints": [
    {
      "title": "Reading permissions as a number",
      "body": "Each of the three permission groups (owner/group/other) is one octal digit: read=4, write=2, execute=1, summed. `644` = owner read+write (6), group read-only (4), other read-only (4).",
      "command": "stat -c '%a %U' /srv/perm-lab/data.txt"
    },
    {
      "title": "Fixing it",
      "body": "`chmod 644 <file>` sets exactly that permission pattern.",
      "command": "chmod 644 /srv/perm-lab/data.txt"
    }
  ],
  "setup_commands": [
    { "command": "id labuser >/dev/null 2>&1 || useradd -m labuser" },
    { "command": "mkdir -p /srv/perm-lab && chmod 755 /srv/perm-lab" },
    { "command": "echo sensitive > /srv/perm-lab/data.txt && chmod 600 /srv/perm-lab/data.txt && chown root:root /srv/perm-lab/data.txt" }
  ],
  "validation": {
    "commands": [
      { "description": "data.txt is now exactly 644", "command": "stat -c '%a' /srv/perm-lab/data.txt", "expected_output": "644", "match": "exact" },
      { "description": "labuser can actually read it now", "command": "su - labuser -c 'cat /srv/perm-lab/data.txt' 2>&1", "expected_output": "sensitive", "match": "exact" }
    ]
  },
  "default_namespace": "default",
  "teardown_commands": [
    { "command": "rm -rf /srv/perm-lab" }
  ]
}