#!/bin/bash
# 03-chown-practice.sh — chown, chgrp, umask, and audit practice
# Companion to Chapter 6: Permissions and Ownership
# nextsteplinux.com/lf6

# 1. Identity Check
echo "=== STEP 1: Your Current Identity ==="
# Knowing your UID and GID is the first step in troubleshooting ownership
id
echo "Your Groups: $(groups)"

# 2. umask Demonstration
echo -e "\n=== STEP 2: The umask (Default Permissions) ==="
# umask defines what permissions are REMOVED from the system default
echo "Current umask: $(umask)"
mkdir -p /tmp/lf6-umask && cd /tmp/lf6-umask

# Create files with default mask (usually 022)
touch default-file.txt
mkdir default-dir
echo "Permissions with default mask (022):"
ls -la | grep "default"

# 3. Changing the umask
echo -e "\n=== STEP 3: Restricting New Files (umask 027) ==="
# 027 removes all permissions for 'others' and write for 'group'
umask 027
touch restricted-file.txt
mkdir restricted-dir
echo "Permissions with restricted mask (027):"
ls -la | grep "restricted"
umask 022 # Restore default for the rest of the script

# 4. chown Examples (Requires sudo)
echo -e "\n=== STEP 4: Ownership Changes (chown) ==="
touch owned.txt
echo "Original Owner: $(ls -l owned.txt | awk '{print $3}')"

# Changing owner to root (This will prompt for your password)
echo "Attempting to change owner to root..."
sudo chown root:root owned.txt
ls -l owned.txt

# Restoring ownership to yourself
sudo chown $USER:$USER owned.txt
echo "Ownership restored to $USER."

# 5. Permission Audit with find
echo -e "\n=== STEP 5: Security Audit (SUID/SGID) ==="
# These find patterns hunt for files with elevated privileges
#
echo "Top 10 SUID binaries in /usr/bin:"
find /usr/bin -perm /4000 -type f 2>/dev/null | head -10

echo -e "\nTop 10 SGID binaries in /usr/bin:"
find /usr/bin -perm /2000 -type f 2>/dev/null | head -10

# Cleanup
echo -e "\n=== Cleanup ==="
cd ~ && rm -rf /tmp/lf6-umask
echo "Done. Practice sandbox removed."