Managing Files

Lesson purpose

File management is reliable when names, metadata, permissions, and recovery consequences are visible. Create, copy, remove, compress, archive, link, secure, and locate Linux files with deliberate control.

Learning objectives

• Manage files, directories, archives, and links safely.
• Control ownership, permissions, defaults, and special modes.
• Locate commands and data within the Filesystem Hierarchy Standard.

LPIC-1 exam focus

• 103.3 Perform basic file management
• 104.5 Manage permissions and ownership
• 104.6 Create and change hard and symbolic links
• 104.7 Find system files and place files correctly

Teaching sequence

1. Linux names are precise and case-sensitive

The central idea is linux names are precise and case-sensitive. Use these points to explain the topic and connect it to the next command or decision.

• Case. file, File, and FILE are distinct names.
• Hidden files. A leading dot hides a name from ordinary ls output.
• Reserved separator. / separates path components and cannot appear inside a filename.
• Shell-sensitive characters. Spaces, quotes, $, *, ?, brackets, semicolons, and other metacharacters require deliberate quoting.

2. Wildcards expand before the command runs

Use this example to show how wildcards expand before the command runs works in a controlled environment.

• ?. Matches exactly one filename character.
• *. Matches zero or more filename characters.
• Bracket expression. Matches one character from a set, range, or negated set.

$ ls b?t
$ ls b[aeiou]t
$ ls b[a-z]t
$ ls b[^0-9]*

3. Listing tools reveal names and metadata

Use the matrix to contrast the named choices before students select a command or configuration.

Item	Meaning
ls -l	Mode, links, owner, group, size, time, name
ls -a	Include hidden entries
ls -i	Show inode numbers
ls -F	Classify entry types
file	Infer content type from data
stat	Display detailed filesystem metadata

Teaching point: Use metadata rather than filename extensions alone to decide what a file is and how it should be handled.

4. Directories and empty files establish structure

Use this example to show how directories and empty files establish structure works in a controlled environment.

• mkdir. Creates directories; -p creates missing parents.
• touch. Creates an empty file or updates timestamps.
• cd and pwd. Move through and verify the current directory.

$ mkdir -p Projects/Linux/Lab1
$ cd Projects/Linux/Lab1
$ touch notes.txt
$ pwd
$ cd -

5. Copy duplicates data; move changes a name or location

This comparison prevents students from treating related tools or layers as interchangeable.

Side	Teaching point
cp	Copies a file; -R recurses, -i prompts, -n avoids overwrite, and -a preserves a hierarchy.
mv	Renames or relocates without creating a second pathname to the same original data.

Decision rule: Before overwriting, verify source, destination, recursion, metadata requirements, and whether the target already exists.

6. Removal requires an explicit safety boundary

Use this example to show how removal requires an explicit safety boundary works in a controlled environment.

• rm. Unlinks files; -r descends through directories.
• rmdir. Removes only empty directories.
• Interactive and force. -i asks; -f suppresses prompts and many errors.

$ rm -i report.txt
$ rmdir empty-dir
$ rm -r project-copy
# Verify the target before using -rf

7. Compression formats trade speed, ratio, and compatibility

Use the matrix to contrast the named choices before students select a command or configuration.

Item	Meaning
gzip / gunzip	.gz; fast and widely available
bzip2 / bunzip2	.bz2; stronger compression, slower
xz / unxz	.xz; high compression, higher resource cost
zip / unzip	.zip; combines multiple files and preserves originals
zcat / bzcat / xzcat	Read compressed content without a permanent extraction

Teaching point: Compression reduces representation size; it is not the same as a multi-file archive unless the format supports both roles.

8. Archives preserve collections and metadata

The central idea is archives preserve collections and metadata. Use these points to explain the topic and connect it to the next command or decision.

• cpio. Copies selected files into or out of an archive stream.
• tar. Creates, lists, compares, and extracts directory trees and metadata.
• dd. Copies raw blocks between files or devices for imaging and low-level transfer.
• Recovery scope. Choose file-level archives or block-level images according to what must be restored.

9. tar combines archive actions with compression

Use this example to show how tar combines archive actions with compression works in a controlled environment.

• Create. c creates; f identifies the archive; v adds verbose output.
• List and extract. t lists; x extracts; verify the destination before extraction.
• Compression. z, j, or J select gzip, bzip2, or xz.

$ tar -czvf project.tgz Project/
$ tar -tzf project.tgz
$ mkdir restore && tar -xzvf project.tgz -C restore

10. dd copies blocks exactly as directed

Use this example to show how dd copies blocks exactly as directed works in a controlled environment.

• Input and output. if= and of= identify source and destination; reversing them can destroy data.
• Block size. bs= controls transfer units and can affect performance.
• Verification. Confirm devices with lsblk and validate the resulting image or copy.

$ sudo dd if=/dev/sdb of=disk.img bs=4M status=progress
$ sha256sum disk.img
# Never guess the of= target

11. Hard and symbolic links connect names differently

This comparison prevents students from treating related tools or layers as interchangeable.

Side	Teaching point
Hard link	A second directory entry references the same inode and data; normally cannot cross filesystems or target directories.
Symbolic link	A distinct inode stores a path to another name; it can cross filesystems and can become dangling.

Decision rule: Use inode numbers and readlink to determine whether two names share data or one name points to another.

12. ln creates links and readlink resolves them

Use this example to show how ln creates links and readlink resolves them works in a controlled environment.

• Hard link. ln source newname creates another name for the same inode.
• Symbolic link. ln -s target link stores the target path.
• Inspection. ls -li shows inode and type; readlink -f resolves a symbolic-link chain.

$ ln ImportantFile.txt BackupName.txt
$ ln -s /opt/app/current app-current
$ ls -li ImportantFile.txt BackupName.txt
$ readlink -f app-current

13. Every file has an owner and group

The central idea is every file has an owner and group. Use these points to explain the topic and connect it to the next command or decision.

• Owner. The user ID controls the owner permission class and administrative responsibility.
• Group. One group ID provides shared access through the group permission class.
• Others. All remaining users receive the other permission class.
• Root authority. Changing ownership normally requires administrative privilege; group changes are constrained by membership and policy.

14. chown and chgrp change identity metadata

Use this example to show how chown and chgrp change identity metadata works in a controlled environment.

• chown. Changes owner and optionally group.
• chgrp. Changes only the assigned group.
• Recursive changes. -R affects a tree and can create broad unintended access changes.

$ sudo chown alice report.txt
$ sudo chown alice:analysts report.txt
$ chgrp analysts report.txt
$ ls -l report.txt

15. rwx means different things for files and directories

Use the matrix to contrast the named choices before students select a command or configuration.

Item	Meaning
Read on file	View file contents
Write on file	Modify file contents
Execute on file	Ask the kernel to run it as a program or script
Read on directory	List names in the directory
Write on directory	Create, remove, or rename entries
Execute on directory	Traverse and access entries when other permissions allow

Teaching point: Directory deletion is controlled primarily by the parent directory, not the file’s own write bit.

16. Symbolic chmod states who, operation, and permission

Use this example to show how symbolic chmod states who, operation, and permission works in a controlled environment.

• Who. u, g, o, or a selects the permission class.
• Operation. + adds, - removes, and = assigns exactly.
• Permission. r, w, and x name the access bits.

$ chmod u+x deploy.sh
$ chmod g-w budget.txt
$ chmod o= report.txt
$ chmod a+r README

17. Octal chmod encodes rwx as numeric sums

Use this example to show how octal chmod encodes rwx as numeric sums works in a controlled environment.

• Values. read=4, write=2, execute=1.
• Three digits. Owner, group, and others each receive one sum.
• Interpretation. 750 means rwx for owner, r-x for group, and — for others.

$ chmod 640 report.txt
$ chmod 750 deploy.sh
$ stat -c '%A %a %n' report.txt deploy.sh

18. umask removes permissions from creation defaults

Use this example to show how umask removes permissions from creation defaults works in a controlled environment.

• File base. Regular files normally begin from 666 so execute is not granted automatically.
• Directory base. Directories normally begin from 777 because traversal is meaningful.
• Mask. Set mask bits are removed from the base; verify the actual result.

$ umask 027
$ touch private.txt     # typically 640
$ mkdir team-dir        # typically 750
$ umask

19. Special bits change execution or directory collaboration

Use the matrix to contrast the named choices before students select a command or configuration.

Item	Meaning
SUID	Executable runs with the file owner’s effective identity
SGID on file	Executable runs with the file group’s effective identity
SGID on directory	New entries inherit the directory’s group
Sticky bit	In a shared directory, users may remove only entries they own, subject to privilege

Teaching point: Special modes expand trust boundaries; inventory and justify them rather than applying them as a shortcut.

20. The FHS guides where files belong

Use the matrix to contrast the named choices before students select a command or configuration.

Item	Meaning
/bin and /sbin	Essential user and administration commands; often merged into /usr
/etc	Host-specific system configuration
/home and /root	Regular-user and root home directories
/usr	Installed programs, libraries, and shareable data
/var	Changing logs, queues, caches, and service data
/tmp	Temporary data
/opt	Add-on application packages

Teaching point: Placement communicates purpose and supports backups, security policy, upgrades, and troubleshooting.

21. Fast lookup tools answer narrow questions

Use the matrix to contrast the named choices before students select a command or configuration.

Item	Meaning
which	Executable selected from PATH
whereis	Common binary, source, and manual locations
type	How the shell interprets a command name
locate	Names from a periodically updated database
updatedb	Refreshes the locate database

Teaching point: Use find when you need live filesystem criteria rather than a quick name lookup.

22. find searches current metadata and can act on results

Use this example to show how find searches current metadata and can act on results works in a controlled environment.

• Starting point. Defines the tree to traverse.
• Tests. Select by name, type, owner, permissions, size, time, and more.
• Actions. -print, -exec, and safe null-delimited pipelines consume matches.

$ find /var/log -type f -name '*.log'
$ find /home -user alice -type f
$ find / -perm /6000 -type f 2>/dev/null
$ find . -type f -print0 | xargs -0 file

23. diff explains text changes

Use this example to show how diff explains text changes works in a controlled environment.

• Comparison. diff reports line-level differences between text files.
• Unified form. -u provides context suitable for review and patch workflows.
• Redirection. Save a patch without modifying either input file.

$ diff -u old.conf new.conf
$ diff -u old.conf new.conf > change.patch

24. Apply the lesson to four scenarios

Ask these questions before revealing the answer key. Require students to name the evidence or command that supports each choice.

1. rm *.log expands to an unexpected set of names. Which component performed the expansion?
2. Two names show the same inode. What kind of relationship is proven?
3. A directory is writable but not executable for a user. What operation is blocked?
4. You need a live search for root-owned SUID/SGID files. Which tool and test fit?

25. Connect each scenario to the governing clue

Use these answers to debrief the knowledge check. The explanation matters as much as the label.

1. The shell. Globbing occurs before rm runs; quote or preview patterns when literal matching is intended.
2. Hard links. Directory entries with the same filesystem and inode reference the same underlying file data.
3. Traversal. Without execute permission, the user cannot access entries through that directory.
4. find with -perm /6000. Search the live filesystem by permission bits, owner if needed, and file type.

26. Three takeaways resolve the lesson

Close the lesson by asking students to restate the decision rule behind each takeaway.

• Names are interpreted in context. Case, paths, quoting, globbing, aliases, links, and metadata determine what an operation targets.
• Recovery starts before deletion. Interactive checks, archives, compression choices, and verified dd targets make consequences manageable.
• Access is layered. Ownership, rwx classes, umask, special modes, FHS placement, and search tools define safe control.

Next lesson connection: Booting, Initializing, and Virtualizing Linux.

Classroom application

Use a disposable VM or lab account for commands that can modify packages, processes, partitions, filesystems, ownership, or permissions. Require students to state the target and expected effect before they run a command.

• Preview a glob before running cp, mv, or rm, and explain which expansion the shell performs before the utility receives its arguments.
• Create a small archive, list it without extraction, restore it into a separate directory, and compare the original and restored text with diff.
• Create a shared directory with an SGID group policy and sticky bit, then test owner, group, and other permissions with two non-root users.

Common misconceptions

• The shell expands globs before rm or another utility runs. Preview a pattern and quote it when a literal metacharacter is intended.
• A hard link shares an inode with the original name. A symbolic link stores a path and can become dangling.
• Directory write permission controls creating, removing, and renaming entries, while directory execute permission controls traversal.
• Filename extensions are conventions. Use file, stat, and metadata rather than trusting an extension alone.

Lesson summary

• Names are interpreted in context. Case, paths, quoting, globbing, aliases, links, and metadata determine what an operation targets.
• Recovery starts before deletion. Interactive checks, archives, compression choices, and verified dd targets make consequences manageable.
• Access is layered. Ownership, rwx classes, umask, special modes, FHS placement, and search tools define safe control.

The next lesson is Booting, Initializing, and Virtualizing Linux.