ACLs, Special Bits & Attributes

An unprivileged user runs passwd and successfully edits /etc/shadow, a file only root can write. How is that possible without giving the user root?

In ls -l you see -rwsr-xr-x on a binary. What does the s mean, what octal bit produced it, and how do you list every such program?

You add a setuid bit to a Python script hoping it will run as root. Why does it silently fail to give root privileges?

The setgid bit means one thing on an executable and something completely different on a directory. What are the two behaviors?

/tmp is world-writable, yet one user cannot delete another user's temp files. What mechanism enforces that?

In ls -l output, an uppercase S or T appears instead of a lowercase s or t. What does the capital letter signal?

You run chmod 0770 on a directory to strip its setgid bit, but ls -l shows the bit is still there. Why, and how do you actually remove it?

Standard Unix permissions give one owner, one group, and everyone else. What do ACLs add on top of that?

You run setfacl on a file and get the error Operation is not supported. What is the usual cause and fix?

You want to give one specific colleague read/write on a file and deny another user entirely, without creating a new group. Which commands do that?

You set an ACL granting a user rw, but the ACL mask is r. What effective access does that user get, and does the mask touch the file owner?

A directory has a default ACL configured. Does that ACL govern who can enter the directory itself?

You copy a carefully ACL'd file with plain cp and back it up with tar, then find the ACL rules gone. Why, and what preserves them?

How do you attach a custom name/value pair to a file with extended attributes, and how do you read it back?

Instead of setuid'ing arping to root just so it can send raw packets, what modern mechanism grants only that one privilege?

Glancing at ls -l, how can you tell at once that a file carries ACL rules beyond its standard permissions?

Two users share a project directory but files keep landing in each creator's personal group, breaking access. Which special bit fixes this, and what does it change?

How do you explicitly pin an ACL mask to cap permissions, and why might that mask silently vanish after your next setfacl?

tar and rsync drop ACL rules, and CD/DVD filesystems can't hold them. How do you back up and restore ACLs around such a backup?

getfattr -d prints nothing for a file you know carries a security.selinux label. Why, and how do you actually see it?

You copy a file with cp -p expecting its extended attributes to ride along. Do they survive, and how should you back EAs up?

Two prerequisites must be met before file capabilities work, and getcap/setcap aren't always installed. What are they?

Why do security guides tell you to avoid the setuid bit when you can, and what protection does a setuid/setgid program remove?

Besides octal codes like 2770, how do you set or clear the setuid, setgid and sticky bits using chmod's symbolic syntax?

Which server is the single biggest real-world reason ACLs exist on Linux, and what does it use them for?

You run getfacl on a brand-new file that has no extra ACL rules. What does it show, and what is that baseline called?