Advanced access control: ACLs, attributes, capabilities and sudoers
Where classic permissions fall short, you apply least privilege with ACLs, immutable attributes, file capabilities and fine-grained sudoers rules.
Level 201 · 16 lessons · 15 practice labs
Lessons
ACLs
- The ACL mask and default ACLs
- Backing up and restoring ACLs
- Untangling unexpected ACL results
- Short task: a project folder shared by three teams with different rights
Attributes and capabilities
- chattr: immutable and append-only
- File capabilities: setcap instead of SUID
- Auditing files and processes that carry capabilities
- Short task: move a tool from SUID to a capability
sudoers
- sudoers syntax: aliases and visudo
- Per-command sudo and wildcard traps
- sudo logs and session recording
- Tidy management with sudoers.d
- Short task: sudo roles for the help desk, database and web teams
Wrap-up
- polkit: authorisation for graphical and D-Bus actions
- Access review: a who-can-do-what report
- Capstone: rebuild least privilege on an inherited server
Practice labs
- Find the permission blocked by the ACL mask: Work out from the mask why a user granted write access by ACL still cannot write, and fix it.
- Make new files inherit the ACL: Define a default ACL on the project folder so newly created files also get the team's ACL.
- Build a folder shared by three teams with different rights: Set ACLs so development reads and writes, testing only reads and support sees one subfolder only, then back them up.
- Find an unauthorised attempt in the sudo log: Use the sudo log to find the user who tried to run a command they are not allowed and what it was.
- Audit files that carry capabilities: List the files carrying capabilities with getcap and find and fix the one granted an unnecessarily broad capability.
- Restore ACLs lost in a copy: Restore the ACLs lost in a careless copy from the getfacl backup with setfacl --restore.
- Find why a file cannot be deleted: Find with lsattr the attribute that stops even root deleting a file, remove it and archive the file.
- Make the audit log append-only: Give the application's audit log the append-only attribute and confirm lines cannot be deleted.
- Move a tool from SUID to a capability: Remove the SUID bit from a tool that needs a low port and grant only the required capability with setcap.
- Close a wildcard hole in sudoers: Show how a wildcard sudo rule meant for reading logs can be abused and narrow the rule.
- Rescue a broken sudoers file: Find the sudoers.d file whose syntax error locked sudo and repair it, validating with visudo -c.
- Set up sudo roles for three teams: Write rules under sudoers.d for the help desk, database and web teams with aliases, separate files and only the needed commands.
- Produce a who-can-do-what report: Combine sudo rules, group memberships and SUID files to report every user's privileges in one table.
- Allow a single action with a polkit rule: Write a polkit rule letting the operators group restart one specific service without a password.
- Rebuild least privilege on an inherited server: Tidy an inherited server full of extra sudo, needless SUID and open ACLs to least privilege and write the change list.
About this course
Where classic permissions fall short, you apply least privilege with ACLs, immutable attributes, file capabilities and fine-grained sudoers rules.
What you will learn
- ACLs
- Attributes and capabilities
- sudoers
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.