Install /usr/local/sbin/cleanup owned by root.
Other users may execute it but must not modify it.
Which owner and mode are appropriate?
root:root with mode 755 lets the owner write while other users can read and execute but cannot alter the script.
Detailed explanation
root:root / 644Incorrect. Mode 644 does not include execute permission.
root:root / 777Incorrect. 777 allows everyone to modify the administration script.
user:user / 755Incorrect. A non-root owner could modify the administration script.
root:root / 755Correct. root owns the file, and 755 gives others read and execute only.
Try it yourself
An example you can run in a temporary verification environment.
file=$(mktemp); chmod 755 "$file"; stat -c '%A %a' "$file"; rm -f -- "$file"Expected result
-rwxr-xr-x 755Key points
- Owner-only write
- Others read and execute
- Keep admin paths unwritable
Notes
- Environment: GNU coreutils 9.x / 一時ファイルでモードだけ検証
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.