Y

Linux and Bash · Beginner

Permissions, processes, ports and disk space

4 min read

Why it matters

Linux appeared in almost half of the DevOps job descriptions we read. The first hour of most incidents is spent on a Linux command line: a service cannot read its config, a port is already in use, a disk is full. Knowing a small set of commands well is worth more than knowing many commands vaguely.

The concept

Permissions. Every file has an owner, a group and three sets of permissions: read (4), write (2) and execute (1) for the owner, the group and everyone else. 640 means owner read and write, group read, others nothing. chmod changes the mode, chown changes the owner. New files get their mode from the umask (commonly 0022, so files are created as 644).

Least privilege. Run services as their own unprivileged user, not root, and make secrets readable only by that user.

Processes and signals. Every process has a PID, an owner and a parent. ps lists processes; kill sends signals. SIGTERM (the default) asks a process to shut down cleanly; SIGKILL (kill -9) ends it immediately with no clean-up, so use it only when SIGTERM fails.

Ports. ss -ltnp lists listening TCP sockets with the owning process.

Disk. df -h shows free space per filesystem; du -sh shows what a directory uses. Large log files are the usual suspect.

Services and logs. On systemd systems, systemctl status name, systemctl restart name and journalctl -u name --since "10 min ago" are the daily commands.

Worked example: a secrets file

A config file with a password is created with default permissions, readable by every user on the machine:

shellsession
$ echo "DB_PASSWORD=example" > app.env
$ ls -l app.env
-rw-r--r-- 1 root root 20 Sep 30 07:57 app.env
$ chmod 600 app.env
$ ls -l app.env
-rw------- 1 root root 20 Sep 30 07:57 app.env

Now only root can read it. But the service runs as the deploy user:

shellsession
$ su deploy -c "cat app.env"
cat: app.env: Permission denied
$ chown deploy:deploy app.env
$ su deploy -c "cat app.env"
DB_PASSWORD=example
$ stat -c '%a %U %n' app.env
600 deploy app.env

The file is now readable by the service user and nobody else (root can always read everything).

Worked example: who is using port 8099?

shellsession
$ ss -ltnp | grep 8099
LISTEN 0      5            0.0.0.0:8099       0.0.0.0:*    users:(("python3",pid=6064,fd=3))
$ ps -o pid,user,cmd -p 6064
  PID USER     CMD
 6064 deploy   python3 -m http.server 8099
$ kill -TERM 6064
$ ps -p 6064 || echo stopped
  PID TTY          TIME CMD
stopped

ps printed only its header because the process no longer exists, and returned an error, so echo stopped ran. SIGTERM was enough; there was no need for kill -9.

Worked example: what is filling the disk?

shellsession
$ du -sh /var/log/app/* | sort -h
50M     /var/log/app/app.log
300M    /var/log/app/app.log.1

An old rotated log uses six times as much space than the live one. Compress or delete old logs, then fix the cause with log rotation (logrotate) and retention limits. One trap: deleting a log file that a process still has open does not free the space until the process closes it; lsof +L1 lists such deleted-but-open files.

Common mistakes

  • chmod 777 to "fix" a permission error. Find which user needs which access and grant only that.

  • Running services as root. A bug in the service then becomes full control of the machine.

  • Reaching for kill -9 first. It skips clean shutdown, which can corrupt data or leave locks.

  • Deleting files to free space without checking what holds them open.

Interview angle

Common questions: explain chmod 640, the difference between SIGTERM and SIGKILL, how to find which process uses a port, how to find what is filling a disk, and what you check first when a service will not start (systemctl status, journalctl -u, permissions on its files, whether its port is free).

Practice task

  1. Create a user app, a directory /srv/app owned by it with mode 750, and a config file inside readable only by app. Prove that another user cannot read it.

  2. Start a process that ignores SIGTERM (for example a Python script that catches it), and observe what kill and kill -9 each do.

Further reading