RTFM · Tools
Permissions, processes and logs in practice
Beyond definitions: how permissions, processes and logging interlock during real diagnostics, and the handful of idioms covering most situations.
Permission triage
id # whoami effectively
namei -l /path/to/stuck/file # per-component perms
stat file # full metadataFix ownership before modes when a copy operation imported the wrong user; guessing chmod masks the real fault.
Process inspection ladder
ps aux | grep -v grep | grep nginx
pgrep -af nginx
vmstat 1 5 # sampled pressure
free -m # memory
uptime # load contextkill -9 as opening move skips the daemon's chance to flush state politely. SIGTERM first; escalate only if genuine unresponsiveness is proven after patience.
Logs as investigation material
Identify the active log sink, then master fewer tools deeply.
tail -f /var/log/messages # follow live
less +F critical.log # forward-scrolling viewer
zgrep ERROR rotated.log.gz # search compressed historyEstablish rotation habits deliberately via logrotate configuration matched to retention norms and disk capacity, checked quarterly. Unbounded growth equals scheduled outage.
Cross-cutting example
# Diagnose HTTP service acting strange:
pgrep -af haproxy
tail -n100 /var/log/haproxy.log
ss -tlnp | grep -E ':443|:80'
namei -l /etc/haproxy/haproxy.cfg # cert/config readable?Prove it works: unified diagnostic fluency
arbitrary misbehaving service gets examined along identity→process→resource→log axes without handbook references.
chmod modes and umask, actually understood
Verified format from the installed chmod manual: a symbolic mode is [ugoa...][[-+=][perms...], where perms draws from rwxXst or the letters ugo. The symbolic grammar is worth memorising because it edits rather than overwrites:
chmod g+w file # ADD group write; octal would need the whole picture
chmod go-rwx secret.conf # REMOVE everything for group/other
chmod u=rw,g=r,o= file # EXACT symbolic assignment per who
chmod 640 secret.conf # octal: same result, one shot
chmod +x deploy.sh # a+x implied for all; X only touches dirs/already-execThe special perms letter X (capital) deserves notice: it sets execute only where it already makes sense, directories and files that already have some execute bit, so you can mark a tree traversable without making every data file executable.
umask is what the system SUBTRACTS from new-file permissions (666 for files, 777 for dirs, minus the mask). A umask of 022 yields 644 files and 755 directories; 027 leaves 'other' with nothing, which is a sensible default on multi-user service hosts:
umask # show current mask
umask 027 # tighten this shell
# persist per-user in ~/.profile or system-wide in /etc/profile.d/The special bits and finding them
| Bit | On a file | On a directory |
|---|---|---|
| setuid (4000, u+s) | Runs with the OWNER's identity (classic: passwd) | Meaningless |
| setgid (2000, g+s) | Runs with the GROUP's identity | New files inherit the DIRECTORY's group: the shared-workspace trick |
| sticky (1000, +t) | Historic swap text: ignore on modern files | Only the owner (or root) may delete entries; think /tmp |
find / -xdev -perm -4000 -type f 2>/dev/null # every setuid binary
find . -perm -2000 -type d # setgid directories
find /tmp -perm -1000 -type d # sticky dirssetuid binaries are privilege-escalation surface. The find above is a periodic audit: every result should be a name you expected. Unexpected setuid is an incident, not a curiosity.
/proc: the filesystem that answers process questions
The ps table earlier reads from /proc. Reading it directly answers questions ps cannot phrase; with cat and grep as your only tools (verified: procps ships, so ps is there; /proc is the kernel's own abacus).
cat /proc/<pid>/status | grep -E 'Name|PPid|Threads|VmRSS'
cat /proc/<pid>/cmdline | tr '\0' ' '; echo # full command, argv-split
ls -l /proc/<pid>/fd # every open fd, and WHERE it points
readlink /proc/<pid>/exe # the real binary (even if deleted paths)
cat /proc/<pid>/environ | tr '\0' '\n' # its environmentThe fd listing is the quiet hero: is that daemon still writing to a rotated log (deleted-but-open)? Does it hold the listening socket you expected? Combine with the earlier lsof +L1 trick for the deleted-file hunt.
Did we miss something?
If this page left something unanswered, found an error, or there is another subject you would like documented, tell us. Saphira’s documentation grows from real problems people need to solve.
Send feedback or request a new section →
Prefer not to do it yourself?
Everything needed to do the work yourself is documented here and remains free; we charge for human time, not for withholding knowledge. Sometimes the missing resource is simply time. The same people who build Saphira can provide paid professional help with implementation, migration, troubleshooting and administration.