Know where commands act

A shell is an interpreter, not the whole operating system

The terminal displays a shell session. The shell reads command text, expands certain expressions, starts commands and connects input and output. A command might be built into the shell or be an executable file. pwd reports your working directory; it does not tell you the directory used by a service that started earlier under a different account.

Run these inspection commands:

printf 'Shell variable: %s\n' "$SHELL"
pwd
id
command -v bash
command -v printf

Record the working directory and your effective user and group identities. $SHELL commonly describes the configured login shell; it does not by itself prove which interpreter is executing a particular script. command -v shows how the shell resolves a name. A shell function, alias or executable path can influence what actually runs. Do not assume that copying a short command name guarantees the same behavior on every machine.

id establishes useful context for access reasoning. A service account may have different groups and a different environment. A successful read in your terminal cannot prove that the service can read the same file.

Build a bounded practice directory

Choose a directory where you are allowed to create practice files. The following commands create a unique lab directory and print its absolute path:

lab_dir=$(mktemp -d "${TMPDIR:-/tmp}/ck-linux.XXXXXX")
printf 'Practice directory: %s\n' "$lab_dir"
mkdir -p "$lab_dir/config" "$lab_dir/logs"
printf 'endpoint=example.invalid\nmode=read-only\n' > "$lab_dir/config/agent.conf"
printf 'INFO agent started\nERROR config unreadable\n' > "$lab_dir/logs/agent.log"
ls -ld "$lab_dir" "$lab_dir/config" "$lab_dir/logs"

Keep the printed path. mktemp chooses a unique name, which avoids reusing a directory that may already contain important files. All writes in this lab are limited to that directory. The endpoint is a reserved example name; no network connection is needed.

The shell variable exists only in the current shell session unless you export it. A new terminal will not necessarily know lab_dir. This is why a troubleshooting note should include the absolute path rather than saying “read the config in my current folder.”

Relative paths depend on working directory

cd "$lab_dir"
pwd
cat config/agent.conf
cat "$lab_dir/config/agent.conf"
cd "$lab_dir/logs"
pwd
cat ../config/agent.conf

All three reads should show the same two configuration lines. config/agent.conf is a relative path interpreted from the current working directory. $lab_dir/config/agent.conf becomes an absolute path when the variable holds the path printed earlier. .. refers to the parent directory of the current path.

Now predict the result of cat config/agent.conf while still inside the logs directory. It should fail because that relative path points at logs/config/agent.conf, which the lab did not create. This is a path-resolution failure, not a reason to grant more permissions.

A path can also refer through a symbolic link. The displayed name and the underlying target may differ. In a real case, inspect the path's components and link targets before asserting which file the process opened. A service working directory, container mount or chroot can make its view different from your interactive shell's view.

File names are data, including their spaces

printf 'training note\n' > "$lab_dir/config/review notes.txt"
cat "$lab_dir/config/review notes.txt"

The quoted path is one argument. Without the quotes, shell word splitting can turn it into separate arguments, causing a command to inspect the wrong paths or fail unexpectedly. Quoting protects argument boundaries; it does not prove that the path is safe or authorized.

Do not build a cleanup command until you can explain exactly which directory it targets. This course deliberately leaves cleanup as an explicit review task. Deleting a whole directory is a state-changing operation; a convenient wildcard does not establish ownership of every matching file.

Evidence exercise

Write down the path used by the successful read, your working directory, your user identity and the two lines returned. Then record the deliberate relative-path failure. Your explanation should identify the changed context without treating the error as a mysterious Linux behavior. A good incident note lets another person repeat the observation under the same context.

Reasoning model

File access depends on the effective identity and every relevant directory boundary, not just the final file mode. Directory execute permission permits traversal; file read permission permits reading content. A service can run as a different user from the administrator’s shell. Broad permission changes may hide a diagnosis while exposing unrelated data. Start with read-only inspection and the least change consistent with the intended access model.

Official reference for further study