· about 25 minutes · runs on ubuntu-26.04-container · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
The reports team — alice, bob and carol, as /srv/reports/TEAM.txt says — shares
/srv/reports. It has never worked. Whoever writes a report is the only one who can change it;
carol cannot open half the files at all; and dave, a contractor who is not on the team, reads
all of it. A previous admin "hardened" logins last year, and things got worse.
This lab runs in a container, not a VM: there is no boot and nothing to reboot. You are learner
with sudo. su - alice (or bob, carol, dave) is how to see the folder through someone's eyes —
the grader looks at it that way too.
What is expected, and graded:
reports; dave is not./srv/reports.reports, and the other two can
read and change it — without anyone running chmod afterwards./srv/reports or read anything in it.Do not solve it with chmod 777: that fails the fourth, and it fails your next audit.
This lab runs in a container — Docker or Podman, no VM — so there is no boot to survive: the checks run once, against the state you left.
| Check | Objective |
|---|---|
| 01_the_whole_team_is_in_the_group | Put exactly the right people in a group |
| 02_the_team_can_edit_every_file | Give a group read and write access to files that already exist |
| 03_new_files_stay_shared | Make files created later belong to the group and stay editable by it |
| 04_outsiders_cannot_read | Keep everyone outside the group out |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
man 1 idman 1 getentman 1 chmodman 5 login.defsman 5 acl4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
alice owns plan.txt, mode 0460 (r--rw----), group reports, and alice is a member of reports. What can alice do with the file?
Read it, but not write it
The kernel picks one class — owner, else group, else other — and uses only its bits. alice is the owner, so r-- applies; her membership in the group adds nothing.
man 7 inode (The file type and mode) · man 2 access
What does this print?
umask 077
touch f
mkdir d
echo "$(stat -c %a f) $(stat -c %a d)"
600 700
touch asks for 0666 and mkdir for 0777; the umask removes the group and other bits, leaving 0600 and 0700. The umask only ever removes bits — it never adds execute to a file.
man 2 umask · man 1 bash (umask) · executed in a sandbox
/srv/reports is drwxrws--- root:reports. alice, in reports, creates a file there with umask 077 and no ACLs. What are its group and mode?
Group reports, mode 0600
The setgid bit on the directory gives new files the directory's group, but it changes no permission bits: the umask still strips the group's access. Group access needs a different umask or a default ACL.
man 7 inode (The set-group-ID bit) · man 2 umask