In this Secure User Context Switching and Access RHCSA lab scenario, I start performing the lab after a 6 minute introduction by the podcast hosts. You will get the most out of this lab if you listen to the entire show and then try to practice the lab several times, either along with me or by yourself. Managing multi-user environments requires a firm grasp of privilege delegation and collaborative file access.
Candidates often fail tasks involving user context because they misunderstand the difference between a login shell and a non-login shell. Furthermore, establishing a shared directory requires more than just basic read and write permissions. It requires the Set Group ID bit to ensure all new files inherit the group ownership of the parent directory, and default ACLs to guarantee group write access, linking the concepts of user management and file permissions.
The core challenge in this scenario is to create two distinct users, grant one of them highly restricted administrative access, establish a collaborative directory, and then switch contexts to verify the setup. You will use system tools to manage user accounts, modify the sudoers directory, alter directory permissions, and securely switch user sessions.
Keywords: RHCSA, RHEL 10, Rocky Linux 10, Switch Users, Linux Permissions, Sudo Configuration, SGID, ACL
EPISODE 041: Secure User Context Switching and Access * Season: 2 | Difficulty: High * Objectives: Primary 1.5, 1.10; Secondary 9.1, 9.4 * Lab Focus: RHCSA, RHEL 10, Rocky Linux 10, Switch Users, Linux Permissions, Sudo Configuration, SGID, ACL * URL: https://djere.com/rhcsa-041-season-2-scenario-16-secure-user-context-switching-and-access.html
1. SCENARIO BRIEF (THE PROBLEM)
The finance department needs a secure, shared workspace for their quarterly reports. You must provision two user accounts: auditor and analyst. Both users must belong to a shared group. The auditor requires specific privileges to restart the NetworkManager service for compliance uploads. Finally, you must create a shared directory where any file created by either user automatically inherits the shared group ownership, and you must verify these conditions by switching between the user contexts.
2. TASK ANALYSIS (THE "WHY")
1.5: Switch Users is necessary to test permissions and execute commands as another user without closing the current SSH session.
1.10: Permissions are required to apply the Set Group ID bit and Access Control Lists (ACLs), ensuring collaborative files maintain the correct group ownership and write access.
9.1: Create/Delete/Modify provides the foundational accounts and group memberships needed for the shared environment.
9.4: Sudo is utilized to grant targeted, limited administrative privileges to a standard user account.
3. SOLUTION STEPS
Step 1: Environment Setup (Root Only)
# Check if sudo and acl are installed and silently install them if missing
# Create the target directory for the finance reports using the p flag to ensure parent paths exist
mkdir -p /opt/finance-reports
# Change the group ownership of the directory to the shared group
chgrp finance-data /opt/finance-reports
# Apply the SGID bit and set read, write, and execute permissions for the group using octal notation 2770
chmod 2770 /opt/finance-reports
# Apply a default ACL to ensure new files always inherit group read and write permissions
setfacl -d -m g::rwx /opt/finance-reports
Step 2: Core Implementation (Execute as Root and Users)
# Switch to the auditor user with a full login environment using the hyphen flag
su - auditor
# Restart the NetworkManager service using sudo to verify the drop-in configuration
sudo systemctl restart NetworkManager
# Create a test file inside the shared directory to evaluate SGID inheritance
touch /opt/finance-reports/q3-audit.txt
# Exit the auditor shell to return to the root prompt
exit
# Switch to the analyst user with a full login environment using the hyphen flag
su - analyst
# Append text to the file created by the auditor using output redirection to verify write access
echo "Reviewed by analyst" >> /opt/finance-reports/q3-audit.txt
# Exit the analyst shell to return to the root prompt
exit
# Technical Breakdown: Using su with the hyphen ensures the environment variables match the target user. The SGID bit on the directory forces new files to inherit the finance-data group, while the default ACL ensures group members can write to them regardless of the creator's umask.
# Pro-Tip: Omitting the hyphen when switching users can leave you with the root environment variables, leading to false positives during permission testing.
Step 3: Verification (The "Proof of Work")
# List the directory details to confirm the SGID bit, group ownership, and ACLs
ls -ld /opt/finance-reports
* EXPECTED: drwxrws---+ 2 root finance-data ...
# List the file details to verify it inherited the finance-data group and write permissions
Context: Generic GNU/Linux certification command examples. Manage user password policies and authentication mechanisms. To manage user password policies and authentication mechanisms in a…
Context: Generic GNU/Linux certification command examples. Understand and modify user and group permissions and ownership. To understand and modify user and group permissions…
Context: Generic GNU/Linux certification command examples. Assign users to appropriate groups. To assign users to appropriate groups in a GNU/Linux system, you can…
