Install /usr/local/sbin/cleanup owned by root.
Other users may execute it but must not modify it.
Which owner and mode are appropriate?
root:root with mode 755 lets the owner write while other users can read and execute but cannot alter the script.
Detailed explanation
root:root / 644Incorrect. Mode 644 does not include execute permission.
Incorrect. Mode 644 does not include execute permission.
root:root / 777Incorrect. 777 allows everyone to modify the administration script.
Incorrect. 777 allows everyone to modify the administration script.
user:user / 755Incorrect. A non-root owner could modify the administration script.
Incorrect. A non-root owner could modify the administration script.
root:root / 755Correct. root owns the file, and 755 gives others read and execute only.
Correct. root owns the file, and 755 gives others read and execute only.
Try it yourself
An example you can run in a temporary verification environment.
file=$(mktemp); chmod 755 "$file"; stat -c '%A %a' "$file"; rm -f -- "$file"Expected result
-rwxr-xr-x 755Key points
- Owner-only write
- Others read and execute
- Keep admin paths unwritable
Notes
- Environment: GNU coreutils 9.x / 一時ファイルでモードだけ検証
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.