ced4568andClaude Sonnet 5
15b616274b
Adds all 6 ROOT 01 modules (how computers run software, the shell, filesystem navigation, files & text, processes, users & permissions foundations), each with a real lesson, demonstration/guided exercise, knowledge check where warranted, a hands-on Lab, and a reflection — 35 activities, 29 new content files. Adds 6 new hands-on Linux scenarios (linux-inspect-hardware, linux-shell-basics, linux-filesystem-navigation, linux-files-and-text, linux-process-management, linux-permissions-foundations) plus 2 MCQ scenarios, using the existing generic scenario/ validation engine (docs/ROOT_FOUNDATIONS_LAB_STRATEGY.md §1) — every one tested end-to-end via the real scenario setup/validate API, including negative tests confirming they correctly FAIL when not actually solved (e.g. the process-management scenario fails while the target process is still running; the permissions scenario is tested against a real `su - labuser` denial). Wires rootnode-linux-foundations-assessment (2 required + 4 random-draw scenarios) using the existing Phase 3B assessment engine. Adds a real, server-side ROOT 01->02->03->04->05 course prerequisite chain (courses.prerequisites) — verified live on two students: one who completed ROOT 01 sees ROOT 02 unlock; a fresh student sees ROOT 02 correctly locked while 03/04/05 stay vacuously satisfied (their own prerequisite courses are still empty). ROOT 06+ and the Capstone are unaffected. Co-Authored-By: Claude Sonnet 5 <[email protected]>
56 lines
1.3 KiB
Markdown
56 lines
1.3 KiB
Markdown
# Demonstration: A Real Permission Denial, and the Real Fix
|
|
|
|
## OBSERVE
|
|
|
|
A file is owned by root with permissions `600` (owner read/write only):
|
|
|
|
```
|
|
$ stat -c '%a %U' data.txt
|
|
600 root
|
|
```
|
|
|
|
## HYPOTHESIS
|
|
|
|
Predict: can a different, non-root user read this file?
|
|
|
|
## INSPECT
|
|
|
|
```
|
|
$ su - labuser -c "cat data.txt"
|
|
cat: data.txt: Permission denied
|
|
```
|
|
|
|
Confirmed — `600` grants nothing to group or other, so `labuser` (neither the owner nor root)
|
|
is correctly denied.
|
|
|
|
## CHANGE
|
|
|
|
Grant read access to everyone, while keeping write access limited to the owner:
|
|
|
|
```
|
|
$ chmod 644 data.txt
|
|
$ stat -c '%a' data.txt
|
|
644
|
|
```
|
|
|
|
## VERIFY
|
|
|
|
```
|
|
$ su - labuser -c "cat data.txt"
|
|
sensitive
|
|
```
|
|
|
|
The exact same command that failed before now succeeds — the permission bits, not the file's
|
|
actual content, were the only thing that changed.
|
|
|
|
## Instructor Notes
|
|
|
|
**Demo goal:** Show a permission denial as a real, reproducible fact (not just a described
|
|
error message) and the exact minimal fix, not an overcorrection like `chmod 777`.
|
|
|
|
**Approximate timing:** 8 minutes live.
|
|
|
|
**Common mistake to watch for:** students reaching for `chmod 777` "to make the error go away"
|
|
— explicitly name why that's wrong (it also grants WRITE to everyone, not just the read access
|
|
actually needed) and connect it back to least privilege.
|