Students read permission strings with ls -l, are refused a file they may not read, turn permissions into digits, and set them with chmod on their own files but not someone else's (AC9TDI10K01 node 3, access control on a real kind of system).
Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.
SlidesDownload Present from the browser, or export to PowerPoint or PDF.
WorksheetDownload Print the student copy; the Teacher edition has the answers.
Students will be able to
I can read a permission string such as rw-r--r--.
I can turn permissions into digits and back.
I can protect a file with chmod, and explain why hiding it doesn't.
Timing
Predict and Try 7 min · Worked example 12 min · Vary 12 min · Practise and Make 14 min
Before class
Try the boards yourself.
The one idea: the operating system checks permissions before every request, and only the owner (or an administrator) can change them. This is Security and privacy's access control (authorisation) on a real kind of system.
Simplification: the pretend computer has no groups, so the middle group of letters is shown but only "owner" and "everyone else" are checked. sudo is refused on purpose.
Running the lesson
Predict: students who said yes think reading gives control.
Try: ask what the operating system checked before refusing.
Worked example: build 640 on the board one group at a time.
Vary: after the refusal, ask why the system lets Lee but not Sam change it.
Make: ask why private keys and password files are usually 600.
The hard part (on purpose)
The digits are the hard part. Keep the 4-2-1 card visible and add up one group at a time.
When students get stuck
What you will see
A question to ask
The fix
A student thinks hidden means private (Sam's mistake).
Can you cat .plans.txt? Could someone else?
Only permissions protect it: chmod 600.
A student's chmod gives an error.
Whose file is it? (ls -l shows the owner.)
You can only chmod your own files.
Answers to the checks
read-only: A file's permissions for everyone else are r--. Can another student change the file? No. r-- means read yes, write no, run no. They can open it but not change or delete it.
Try: Lee's files: Look at Lee's files with ls -l /home/lee. Try to read both with cat. Which one can you read?
The timetable (rw-r--r--: everyone may read). marks.txt is rw-------: only Lee.
-rw-r--r--, letter by letter: rw-r----- as three digits (read 4, write 2, run 1, for owner, group, everyone else)? 640 rw- = 4 + 2 = 6; r-- = 4; --- = 0. So 640.
Find the mistake: Sam hides a file. Click the line where it first goes wrong. line 3 Line 3: hidden only means plain ls skips it. Anyone can ls -a and cat it if the permissions allow. chmod 600 is what protects it.
Who can chmod?: Who can change a file's permissions with chmod? Its owner (and an administrator) That's why you couldn't chmod Lee's file.
Hide it properly: Make .plans.txt unreadable to everyone except you. Check with ls -la.
chmod o-r .plans.txt (or chmod 600 .plans.txt). Now hiding it doesn't matter: the permissions protect it.
Let it run: Let yourself run projects/robot.py as a program (x for the owner).
chmod u+x projects/robot.py: rwxr--r--, 744.
Not yours: Try to make Lee's marks.txt readable with chmod 644. What happens?
Refused: only the owner (or an administrator) can change a file's permissions.
755: A file is rwxr-xr-x (755). Can everyone else run it? Yes: their group is r-x r-x: read and run, but not change.
Private: Which digits mean only the owner can read and write, and nobody else can do anything? 600 rw------- = 600: the setting for private files and keys.
Review: pipes: Review: what does grep error log.txt | wc -l print? How many lines of log.txt contain error grep picks the lines; wc -l counts them.
lock your plans: Your .plans.txt should be readable and changeable by you, and nobody else should be able to do anything with it.
600: rw-------. That's how private files, passwords and keys are kept on servers.
Solutions
One possible solution for each task. Other correct programs are fine.
Vary: change who can do what › Hide it properly
Open task: any program that does what the step asks.
Vary: change who can do what › Let it run
Open task: any program that does what the step asks.
Vary: change who can do what › Not yours
Open task: any program that does what the step asks.
lock your plans
Open task: any program that does what the step asks.
Stretch and support
Stretch: Find out what chmod 777 means and why people say never to use it.
Support: A 4-2-1 card: r = 4, w = 2, x = 1, added for owner, group, everyone else.
Exit ticket
What does rw-r----- mean, and how would you make it so only you can read it?
The owner can read and write, the group can read, everyone else nothing (640). chmod 600 file (or chmod g-r file).
What each step is for
read-only: Committing to what r-- allows tests the new move: each letter is one permission.
Try: Lee's files: Trying to read two of the teacher's files settles the prediction: one is allowed, one is refused.
Worked example: reading rw-r--r--: Splitting a permission string into its two groups and turning it into digits models the new move. Sam trusts a hidden name, the misconception planted after the method.
Vary: change who can do what: Each task changes one permission: take read away from others, add run for the owner, then try to change a file you don't own.
permissions: Reading and choosing permissions without the board is the same move in mixed forms, plus a review of pipes.
lock your plans: Setting a file to exact permissions reverses the process: from who should be allowed to the digits or letters that say so.
Where it leads
Links: Security and privacy › Who are you, and what may you do? (authentication and permissions); Cyber security (planned).