LFCS Phase 1 Part 20: Understanding Write Permissions and Access Control

# Navigate home
cd ~
pwd
# Output: /home/centos9

# Method 1: touch command
touch testfile1.txt

# Method 2: echo redirect
echo "Test content" > testfile2.txt

# Method 3: Using cat with heredoc
cat > testfile3.txt << EOF
Line 1
Line 2
EOF

# Create directory
mkdir testdir

# Verify all created successfully
ls -la
# Look for: testfile1.txt, testfile2.txt, testfile3.txt, testdir/

# Check you own them
ls -l testfile1.txt
# Output shows your username as owner and group

# Cleanup
rm testfile*.txt
rmdir testdir

# Create file in /tmp
touch /tmp/mytest.txt
echo "Temporary data" > /tmp/mytest.txt

# Check permissions
ls -l /tmp/mytest.txt
# Output: -rw-r--r--. 1 centos9 centos9 15 Dec  7 10:30 /tmp/mytest.txt
# Notice: You own it, even though it's in a shared directory

# Check /tmp directory itself
ls -ld /tmp
# Output: drwxrwxrwt. 15 root root 4096 Dec  7 10:30 /tmp
#                    ^
#                    't' = sticky bit (important!)

# The sticky bit means: Only owner can delete their own files
# Even though everyone can write to /tmp, they can't delete YOUR files

# Create directory
mkdir /tmp/myproject
ls -ld /tmp/myproject
# Output: drwxr-xr-x. 2 centos9 centos9 6 Dec  7 10:32 /tmp/myproject

# Cleanup
rm /tmp/mytest.txt
rmdir /tmp/myproject

# Test /root
touch /root/test.txt
# Output: touch: cannot touch '/root/test.txt': Permission denied

# Test /etc
touch /etc/test.txt
# Output: touch: cannot touch '/etc/test.txt': Permission denied

# Test /var/log
touch /var/log/test.txt
# Output: touch: cannot touch '/var/log/test.txt': Permission denied

# Test /boot
touch /boot/test.txt
# Output: touch: cannot touch '/boot/test.txt': Permission denied

# Test /usr/bin
touch /usr/bin/test.txt
# Output: touch: cannot touch '/usr/bin/test.txt': Permission denied

# Why are these protected?
ls -ld /root /etc /var/log /boot /usr/bin

# Output analysis:
# /root: drwx------. (only root has any access)
# /etc: drwxr-xr-x. (root owns, others can only read)
# /var/log: drwxr-xr-x. (root owns, others can only read)
# /boot: dr-xr-xr-x. (read-only even for root on some systems)
# /usr/bin: dr-xr-xr-x. (read and execute only)

# Attempt without sudo (will fail)
touch /etc/test.conf
# Output: touch: cannot touch '/etc/test.conf': Permission denied

# Attempt with sudo (will succeed)
sudo touch /etc/test.conf

# Verify it was created
ls -l /etc/test.conf
# Output: -rw-r--r--. 1 root root 0 Dec  7 10:40 /etc/test.conf
# Notice: Owner is 'root' not your username!

# When you use sudo, the file is created AS root

# Add content with sudo
sudo bash -c "echo 'test configuration' > /etc/test.conf"

# View it (no sudo needed for reading)
cat /etc/test.conf
# Output: test configuration

# IMPORTANT: Clean up after yourself!
sudo rm /etc/test.conf

# Verify deletion
ls -l /etc/test.conf
# Output: ls: cannot access '/etc/test.conf': No such file or directory

# Error 1: File doesn't exist
cat /home/centos9/nonexistent.txt
# Output: cat: /home/centos9/nonexistent.txt: No such file or directory

# Error 2: File exists but can't read
cat /etc/shadow
# Output: cat: /etc/shadow: Permission denied

ls -l /etc/shadow
# Output: ----------. 1 root root 1234 Dec  6 10:00 /etc/shadow
# No read permissions for anyone except root!

# Error 3: Directory doesn't exist
touch /nonexistent/test.txt
# Output: touch: cannot touch '/nonexistent/test.txt': No such file or directory
# (Can't create file in directory that doesn't exist)

# Error 4: Directory exists but is protected
touch /root/test.txt
# Output: touch: cannot touch '/root/test.txt': Permission denied

# Compare error messages:
# "No such file or directory" = doesn't exist
# "Permission denied" = exists but you lack permission

# This distinction is CRITICAL for troubleshooting!

# Create the script
cat > ~/test_write.sh << 'EOF'
#!/bin/bash

# Function to test write access
test_write() {
    local dir=$1
    local testfile="$dir/write_test_$$"

    if touch "$testfile" 2>/dev/null; then
        echo "✅ CAN WRITE: $dir"
        rm -f "$testfile"
        return 0
    else
        echo "❌ CANNOT WRITE: $dir"
        return 1
    fi
}

# Test various directories
echo "=== Testing Write Access ==="
test_write "$HOME"
test_write "/tmp"
test_write "/root"
test_write "/etc"

# Alternative: Using $? directly
echo
echo "=== Using Exit Code Checks ==="

touch /tmp/test.txt 2>/dev/null
if [ $? -eq 0 ]; then
    echo "/tmp is writable"
    rm -f /tmp/test.txt
else
    echo "/tmp is not writable"
fi

touch /root/test.txt 2>/dev/null
if [ $? -eq 0 ]; then
    echo "/root is writable"
    rm -f /root/test.txt
else
    echo "/root is not writable"
fi
EOF

# Make executable
chmod +x ~/test_write.sh

# Run it
./~/test_write.sh

# Create file in /tmp
touch /tmp/test_tmp.txt
echo "Created: $(date)" > /tmp/test_tmp.txt
ls -l /tmp/test_tmp.txt

# Create file in /var/tmp
touch /var/tmp/test_vartmp.txt
echo "Created: $(date)" > /var/tmp/test_vartmp.txt
ls -l /var/tmp/test_vartmp.txt

# Compare directory permissions
ls -ld /tmp /var/tmp
# Both have sticky bit (t) and are world-writable

# Key differences:
echo "=== /tmp vs /var/tmp ==="
echo "/tmp:"
echo "  - Cleared on reboot"
echo "  - Use for very temporary files (seconds to hours)"
echo "  - Example: extraction of archives, compilation temp files"
echo
echo "/var/tmp:"
echo "  - Survives reboots"
echo "  - Use for temporary files that might be needed across reboots"
echo "  - Example: large downloads, package manager temp files"

# Practical example: Check what's actually in each
echo
echo "Files in /tmp:"
ls -lt /tmp | head -10

echo
echo "Files in /var/tmp:"
ls -lt /var/tmp | head -10

# Cleanup
rm /tmp/test_tmp.txt /var/tmp/test_vartmp.txt

# Create test environment
mkdir -p ~/test_system/{etc,var/log,usr/bin,tmp,root}

# Verify structure
tree ~/test_system
# or use: find ~/test_system -type d

# Now you can safely practice:

# 1. Practice creating config files
touch ~/test_system/etc/myapp.conf
echo "setting=value" > ~/test_system/etc/myapp.conf

# 2. Practice log management
echo "[INFO] Application started" > ~/test_system/var/log/app.log
echo "[ERROR] Connection failed" >> ~/test_system/var/log/app.log

# 3. Practice script installation
cat > ~/test_system/usr/bin/myscript << 'EOF'
#!/bin/bash
echo "This is my script"
EOF
chmod +x ~/test_system/usr/bin/myscript

# 4. Test without risking real system
rm ~/test_system/etc/myapp.conf
# No risk! It's just your test environment

# This is MUCH safer than experimenting on real /etc or /var!

# When you're confident, apply to real system:
# sudo cp ~/test_system/etc/myapp.conf /etc/
# sudo cp ~/test_system/usr/bin/myscript /usr/local/bin/

# Create a problematic script
cat > ~/buggy_backup.sh << 'EOF'
#!/bin/bash

# Buggy backup script
LOG_DIR="/var/log/myapp"
BACKUP_DIR="/backup"
CONFIG_FILE="/etc/myapp.conf"

# Try to create log
echo "Starting backup..." > $LOG_DIR/backup.log

# Try to create backup directory
mkdir -p $BACKUP_DIR

# Try to read config
cat $CONFIG_FILE

echo "Backup complete"
EOF

chmod +x ~/buggy_backup.sh

# Run it (will fail)
./~/buggy_backup.sh
# Output: Multiple permission denied errors

# Analyze the problems:
echo "=== Problem Analysis ==="

# Problem 1: Can't write to /var/log
ls -ld /var/log
# Output: drwxr-xr-x. root root (not writable by regular user)

# Problem 2: Can't create /backup
ls -ld /backup 2>/dev/null || echo "/backup doesn't exist, can't create in /"

# Problem 3: Config file doesn't exist
ls -l /etc/myapp.conf
# Output: No such file or directory

# Create FIXED version
cat > ~/fixed_backup.sh << 'EOF'
#!/bin/bash

# Fixed backup script
LOG_DIR="$HOME/myapp_logs"      # Use home directory instead
BACKUP_DIR="$HOME/backups"      # Use home directory instead
CONFIG_FILE="$HOME/.myapp.conf" # Use home directory instead

# Create directories if they don't exist
mkdir -p $LOG_DIR
mkdir -p $BACKUP_DIR

# Create log
echo "Starting backup at $(date)" > $LOG_DIR/backup.log

# Create/read config
if [ ! -f $CONFIG_FILE ]; then
    echo "backup_source=$HOME/Documents" > $CONFIG_FILE
fi

cat $CONFIG_FILE

echo "Backup complete" | tee -a $LOG_DIR/backup.log
EOF

chmod +x ~/fixed_backup.sh

# Run fixed version
./~/fixed_backup.sh
# Output: Success!

# Verify
ls -la ~/myapp_logs ~/backups
cat ~/myapp_logs/backup.log

# Create file as regular user
touch ~/userfile.txt
ls -l ~/userfile.txt
# Output: -rw-r--r--. 1 centos9 centos9 0 Dec  7 11:00 userfile.txt
# Owner: centos9, Group: centos9

# Create file with sudo
sudo touch ~/rootfile.txt
ls -l ~/rootfile.txt
# Output: -rw-r--r--. 1 root root 0 Dec  7 11:01 rootfile.txt
# Owner: root, Group: root (even though it's in YOUR home!)

# Problem: You can't modify root-owned file
echo "test" >> ~/rootfile.txt
# Output: bash: ~/rootfile.txt: Permission denied

# Solution 1: Use sudo to modify
sudo bash -c "echo test >> ~/rootfile.txt"

# Solution 2: Change ownership to yourself
sudo chown centos9:centos9 ~/rootfile.txt
ls -l ~/rootfile.txt
# Output: -rw-r--r--. 1 centos9 centos9 5 Dec  7 11:02 rootfile.txt

# Now you can modify it
echo "more data" >> ~/rootfile.txt
# Success!

# Best Practice: If creating files in your home, don't use sudo
# Only use sudo when writing to system directories

# Cleanup
rm ~/userfile.txt ~/rootfile.txt

# Try to access root's bash history
cat /root/.bash_history
# Output: cat: /root/.bash_history: Permission denied

# Is it the FILE or the DIRECTORY that's blocked?
ls -l /root/.bash_history
# Output: ls: cannot access '/root/.bash_history': Permission denied

# It's the directory! Check /root permissions
ls -ld /root
# Output: dr-xr-x---. 2 root root 135 Dec  7 10:00 /root
#                  ^^^
#                  No execute permission for others!

# In Linux, to access /root/.bash_history, you need:
# 1. Execute permission on / (you have it)
# 2. Execute permission on /root (you DON'T have it)
# 3. Read permission on .bash_history (doesn't matter, you can't reach it)

# With sudo, you can access it
sudo cat /root/.bash_history
# This works (if the file exists)

# Real-world example: Web server directory permissions
# For a web server to serve /var/www/html/site/page.html:
# - Execute permission on /var
# - Execute permission on /var/www
# - Execute permission on /var/www/html
# - Execute permission on /var/www/html/site
# - Read permission on page.html
# If ANY directory in the chain lacks execute, access fails!

# Create a file in /tmp
echo "User centos9's data" > /tmp/centos9_file.txt
ls -l /tmp/centos9_file.txt
# Output: -rw-r--r--. 1 centos9 centos9 20 Dec  7 11:10 /tmp/centos9_file.txt

# Check /tmp permissions
ls -ld /tmp
# Output: drwxrwxrwt. 15 root root 4096 Dec  7 11:10 /tmp
#                    ^
#                    't' = sticky bit

# The sticky bit means:
# - Everyone can create files (rwx for all)
# - But only the owner can delete their own files

# Try to delete your own file (works)
rm /tmp/centos9_file.txt
# Success!

# Recreate it
echo "User centos9's data" > /tmp/centos9_file.txt

# If you were another user, you COULD:
# - Read the file (if permissions allow)
cat /tmp/centos9_file.txt
# Output: User centos9's data

# - Create your own file
touch /tmp/another_file.txt

# But you COULD NOT:
# - Delete centos9's file (even though /tmp is world-writable!)
# - Modify centos9's file (unless permissions allow)

# This is what the sticky bit prevents!

# Without sticky bit, any user could delete ANY file in a shared directory
# With sticky bit, users can only delete their OWN files

# Real-world: This is why /tmp is safe for multi-user systems!

# Cleanup
rm /tmp/centos9_file.txt /tmp/another_file.txt

cat > ~/write_access_audit.sh << 'EOF'
#!/bin/bash

# Write Access Audit Tool
# Tests common directories and generates a report

OUTPUT_FILE="$HOME/write_access_report_$(date +%Y%m%d_%H%M%S).txt"

echo "==================================" | tee $OUTPUT_FILE
echo "Linux Write Access Audit Report" | tee -a $OUTPUT_FILE
echo "Date: $(date)" | tee -a $OUTPUT_FILE
echo "User: $(whoami)" | tee -a $OUTPUT_FILE
echo "==================================" | tee -a $OUTPUT_FILE
echo | tee -a $OUTPUT_FILE

# List of directories to test
test_dirs=(
    "$HOME"
    "$HOME/Documents"
    "/tmp"
    "/var/tmp"
    "/root"
    "/etc"
    "/var/log"
    "/usr/bin"
    "/usr/local/bin"
    "/boot"
    "/var/www"
    "/opt"
)

writable=0
not_writable=0

echo "Testing write access to common directories..." | tee -a $OUTPUT_FILE
echo | tee -a $OUTPUT_FILE

for dir in "${test_dirs[@]}"; do
    testfile="$dir/.write_test_$$"

    if [ ! -d "$dir" ]; then
        printf "%-30s DOES NOT EXIST\n" "$dir" | tee -a $OUTPUT_FILE
        continue
    fi

    if touch "$testfile" 2>/dev/null; then
        printf "%-30s ✅ WRITABLE\n" "$dir" | tee -a $OUTPUT_FILE
        rm -f "$testfile"
        ((writable++))
    else
        printf "%-30s ❌ NOT WRITABLE\n" "$dir" | tee -a $OUTPUT_FILE
        ((not_writable++))
    fi
done

echo | tee -a $OUTPUT_FILE
echo "==================================" | tee -a $OUTPUT_FILE
echo "Summary:" | tee -a $OUTPUT_FILE
echo "  Writable: $writable" | tee -a $OUTPUT_FILE
echo "  Not Writable: $not_writable" | tee -a $OUTPUT_FILE
echo "==================================" | tee -a $OUTPUT_FILE
echo | tee -a $OUTPUT_FILE
echo "Report saved to: $OUTPUT_FILE" | tee -a $OUTPUT_FILE
EOF

chmod +x ~/write_access_audit.sh

# Run the audit
./~/write_access_audit.sh

# View the report
cat ~/write_access_report_*.txt

# Create a script that generates files
cat > ~/generate_files.sh << 'EOF'
#!/bin/bash

mkdir -p ~/output
cd ~/output

for i in {1..5}; do
    echo "File $i content" > file$i.txt
done

echo "Created files in ~/output"
ls -l ~/output
EOF

chmod +x ~/generate_files.sh

# Run as regular user
./~/generate_files.sh

# Check ownership
ls -l ~/output
# Output: All files owned by centos9

# Clean up
rm -rf ~/output

# Now run with sudo (BAD IDEA!)
sudo ./home/centos9/generate_files.sh

# Check ownership
ls -l ~/output
# Output: All files owned by ROOT!

# Problem: Now YOU can't modify your own files!
echo "test" >> ~/output/file1.txt
# Output: Permission denied

# This is a common mistake!

# Why this happens:
# - sudo runs the ENTIRE script as root
# - When script uses ~/, it expands to the user running the script
# - But since sudo runs as root, ~ = /root in some contexts
# - Files created are owned by root

# Lesson: DON'T run personal scripts with sudo unless necessary!

# Fix: Change ownership back
sudo chown -R centos9:centos9 ~/output

# Or: Rewrite script to create files without sudo
# Only use sudo for operations that REQUIRE it

# Cleanup
rm -rf ~/output

# Example: Safely modifying /etc/hosts

# Step 1: ALWAYS backup first
sudo cp /etc/hosts /etc/hosts.backup.$(date +%Y%m%d)

# Verify backup exists
ls -l /etc/hosts.backup.*

# Step 2: Copy to your home for editing (safer)
cp /etc/hosts ~/hosts.new

# Step 3: Edit in your home directory (no risk to system)
nano ~/hosts.new
# Add test entry: 127.0.0.1  test.local

# Step 4: Verify your changes
diff /etc/hosts ~/hosts.new
# Shows what changed

# Step 5: Apply to system
sudo cp ~/hosts.new /etc/hosts

# Step 6: Test the change
ping -c 1 test.local
# Should resolve to 127.0.0.1

# Step 7: If something breaks, rollback is easy
# sudo cp /etc/hosts.backup.YYYYMMDD /etc/hosts

# Best Practice Workflow Summary:
echo "=== Safe System File Modification Workflow ==="
echo "1. sudo cp /etc/file /etc/file.backup.\$(date +%Y%m%d)"
echo "2. cp /etc/file ~/file.new"
echo "3. nano ~/file.new (edit safely)"
echo "4. diff /etc/file ~/file.new (verify changes)"
echo "5. sudo cp ~/file.new /etc/file (apply)"
echo "6. Test functionality"
echo "7. If broken: sudo cp /etc/file.backup.YYYYMMDD /etc/file"

# Cleanup (careful here!)
# sudo cp /etc/hosts.backup.* /etc/hosts
# sudo rm /etc/hosts.backup.*
# rm ~/hosts.new

# Check mounted filesystems
mount | grep -E '/boot|/usr'

# /boot is often read-only or restricted
ls -ld /boot
# Output: dr-xr-xr-x. or drwxr-xr-x. with root owner

# Try to write
touch /boot/test.txt
# Output: Permission denied (or "Read-only file system" if mounted ro)

# Why is /boot protected?
echo "=== Why /boot is critical ==="
ls /boot
# Contains: vmlinuz (kernel), initramfs, grub config

# If /boot gets corrupted:
# - System won't boot
# - Kernel can't load
# - Recovery requires rescue media

# Some systems mount /boot as read-only by default
# It's only mounted read-write during kernel updates

# Check if mounted read-only
mount | grep /boot
# Look for "ro" (read-only) vs "rw" (read-write)

# During kernel updates, package manager will:
# 1. Remount /boot as read-write
# 2. Update kernel files
# 3. Remount /boot as read-only

# You can manually remount (if needed):
# sudo mount -o remount,rw /boot  # Make writable
# sudo mount -o remount,ro /boot  # Make read-only again

# But for normal users, /boot should NEVER be writable!

# Check current sudo timeout setting
sudo -V | grep timeout
# Default is usually 5 minutes (300 seconds)

# Use sudo to write to /etc
sudo touch /etc/test1.txt
# Enter password

# Immediately use sudo again (within timeout)
sudo touch /etc/test2.txt
# No password prompt! Cached from previous command

# Check timeout remaining (there's no direct command, but you can test)
sudo -n touch /etc/test3.txt 2>&1
# -n = non-interactive (fail if password needed)
# If succeeds: still in timeout window
# If fails: timeout expired

# To clear sudo cache immediately
sudo -k
# Kills the credential cache

# Now try again
sudo touch /etc/test4.txt
# Password prompt again

# Why this matters:
echo "=== Sudo Timeout Security Implications ==="
echo "1. Timeout allows multiple commands without re-entering password"
echo "2. But means unlocked terminal = potential security risk"
echo "3. Use 'sudo -k' when leaving terminal unattended"
echo "4. Or configure shorter timeout in /etc/sudoers"

# View sudo config (timeout setting)
sudo cat /etc/sudoers | grep timeout
# Look for: Defaults timestamp_timeout=5

# Cleanup
sudo rm /etc/test*.txt

cat > ~/file_access_guide.md << 'EOF'
# File Access Decision Matrix

## Quick Decision Guide

### Personal Data or Project Files
- **Location**: `~/` (your home directory)
- **Example**: `~/Documents/project/data.txt`
- **Why**: Full control, persistent, backed up
- **sudo needed**: No

### Temporary Working Files (Short-term)
- **Location**: `/tmp`
- **Example**: `/tmp/extraction/archive_contents/`
- **Why**: Shared, auto-cleaned on reboot
- **sudo needed**: No
- **Warning**: Don't store important data here!

### Temporary Files (Across Reboots)
- **Location**: `/var/tmp`
- **Example**: `/var/tmp/large_download.iso`
- **Why**: Persists across reboots, shared
- **sudo needed**: No

### System Configuration Files
- **Location**: `/etc`
- **Example**: `/etc/myapp/config.ini`
- **Why**: System-wide configuration
- **sudo needed**: YES
- **Best Practice**: Edit copy in ~/ first, then sudo cp to /etc

### System-wide Scripts/Binaries
- **Location**: `/usr/local/bin`
- **Example**: `/usr/local/bin/backup-script`
- **Why**: Available to all users, in PATH
- **sudo needed**: YES
- **Alternative**: `~/bin` (personal scripts)

### Application Logs
- **Location**: `/var/log` OR `~/logs/`
- **Why**: System logs in /var/log (need sudo), app logs in ~/
- **sudo needed**: YES for /var/log, No for ~/logs
- **Best Practice**: Use ~/logs for personal applications

### Web Server Content
- **Location**: `/var/www/html`
- **Why**: Web server document root
- **sudo needed**: YES
- **Alternative**: Configure virtual host pointing to ~/public_html

## Decision Flowchart

1. Is this a system configuration?
   - YES → /etc (with sudo)
   - NO → Continue

2. Should all users access this?
   - YES → /usr/local or /opt (with sudo)
   - NO → Continue

3. Is this temporary data?
   - YES, very short-term → /tmp
   - YES, might need after reboot → /var/tmp
   - NO → Continue

4. Is this your personal data?
   - YES → ~/
   - NO → Reconsider if you should be creating this file!

## Common Mistakes

1. ❌ Running personal scripts with sudo
   - Creates root-owned files in your home directory

2. ❌ Storing important data in /tmp
   - Will be deleted on reboot!

3. ❌ Editing /etc files directly without backup
   - Always: sudo cp /etc/file /etc/file.backup.$(date +%Y%m%d)

4. ❌ Creating files in / (root directory)
   - Use specific subdirectories instead

5. ❌ Using sudo when not needed
   - Principle of least privilege: only elevate when necessary
EOF

# View the guide
cat ~/file_access_guide.md

echo
echo "Guide saved to: ~/file_access_guide.md"
echo "Use: cat ~/file_access_guide.md anytime for reference"

# Scenario: You're setting up a backup script that should run via cron

# Create the problematic setup
cat > ~/backup_app.sh << 'EOF'
#!/bin/bash
LOG_FILE="/var/log/backup.log"
BACKUP_DIR="/backups"
SOURCE_DIR="$HOME/Documents"

echo "[$(date)] Starting backup..." >> $LOG_FILE
mkdir -p $BACKUP_DIR
tar -czf $BACKUP_DIR/backup_$(date +%Y%m%d).tar.gz $SOURCE_DIR
echo "[$(date)] Backup complete" >> $LOG_FILE
EOF

chmod +x ~/backup_app.sh

# Try to run it
./~/backup_app.sh
# Output: Multiple permission errors!

# Let's diagnose systematically:
echo "=== Diagnosis Process ==="

# Problem 1: Can't write to /var/log/backup.log
echo "1. Testing log file access:"
touch /var/log/backup.log
# Output: Permission denied

ls -ld /var/log
# Output: drwxr-xr-x. root root (not writable)

echo "   Solution: Use ~/logs instead of /var/log"

# Problem 2: Can't create /backups
echo "2. Testing backup directory creation:"
mkdir /backups
# Output: Permission denied

echo "   Solution: Use ~/backups instead of /backups"

# Problem 3: Even if we use sudo, cron won't have the password
echo "3. This script won't work in cron with sudo!"

# Create FIXED version
cat > ~/backup_app_fixed.sh << 'EOF'
#!/bin/bash

# Fixed version using user-accessible locations
LOG_DIR="$HOME/logs"
BACKUP_DIR="$HOME/backups"
SOURCE_DIR="$HOME/Documents"

# Create directories if they don't exist
mkdir -p $LOG_DIR
mkdir -p $BACKUP_DIR

# Log file path
LOG_FILE="$LOG_DIR/backup.log"

# Perform backup
echo "[$(date)] Starting backup..." >> $LOG_FILE

if tar -czf $BACKUP_DIR/backup_$(date +%Y%m%d).tar.gz $SOURCE_DIR 2>>$LOG_FILE; then
    echo "[$(date)] Backup complete: $BACKUP_DIR/backup_$(date +%Y%m%d).tar.gz" >> $LOG_FILE
else
    echo "[$(date)] Backup FAILED!" >> $LOG_FILE
    exit 1
fi

# Optional: Clean old backups (keep last 7 days)
find $BACKUP_DIR -name "backup_*.tar.gz" -mtime +7 -delete

echo "[$(date)] Cleanup complete" >> $LOG_FILE
EOF

chmod +x ~/backup_app_fixed.sh

# Test fixed version
./~/backup_app_fixed.sh
# Success!

# Verify it worked
ls -lh ~/backups/
cat ~/logs/backup.log

# Now this can be added to cron:
echo "To add to cron: crontab -e"
echo "Add line: 0 2 * * * $HOME/backup_app_fixed.sh"

# Cleanup
rm -rf ~/backups ~/logs

cat > ~/master_write_access_check.sh << 'EOF'
#!/bin/bash

# Master Write Access Analysis Tool
# Comprehensive check of Linux file access control

REPORT_DIR="$HOME/access_reports"
REPORT_FILE="$REPORT_DIR/access_report_$(date +%Y%m%d_%H%M%S).txt"

mkdir -p $REPORT_DIR

# Header
{
    echo "========================================"
    echo "  Linux Write Access Master Report"
    echo "========================================"
    echo "Generated: $(date)"
    echo "Hostname: $(hostname)"
    echo "User: $(whoami)"
    echo "UID: $(id -u)"
    echo "Groups: $(id -Gn)"
    echo "========================================"
    echo

    # Section 1: User Writable Locations
    echo "SECTION 1: USER WRITABLE LOCATIONS"
    echo "------------------------------------"

    for dir in "$HOME" "$HOME/Documents" "/tmp" "/var/tmp"; do
        if touch "$dir/.test_$$" 2>/dev/null; then
            printf "✅ %-30s WRITABLE\n" "$dir"
            rm -f "$dir/.test_$$"
        else
            printf "❌ %-30s NOT WRITABLE\n" "$dir"
        fi
    done

    echo

    # Section 2: Protected System Locations
    echo "SECTION 2: PROTECTED SYSTEM LOCATIONS"
    echo "--------------------------------------"

    for dir in "/root" "/etc" "/var/log" "/usr/bin" "/boot"; do
        if touch "$dir/.test_$$" 2>/dev/null; then
            printf "⚠️  %-30s WRITABLE (UNEXPECTED!)\n" "$dir"
            rm -f "$dir/.test_$$"
        else
            printf "✅ %-30s PROTECTED (correct)\n" "$dir"
        fi
    done

    echo

    # Section 3: Directory Permissions Analysis
    echo "SECTION 3: DIRECTORY PERMISSIONS"
    echo "---------------------------------"

    for dir in "/" "/home" "$HOME" "/tmp" "/root" "/etc" "/var/log"; do
        if [ -d "$dir" ]; then
            perms=$(ls -ld "$dir" 2>/dev/null | awk '{print $1, $3, $4}')
            printf "%-20s %s\n" "$dir" "$perms"
        fi
    done

    echo

    # Section 4: Sudo Access Check
    echo "SECTION 4: SUDO ACCESS CHECK"
    echo "----------------------------"

    if sudo -n true 2>/dev/null; then
        echo "✅ Sudo credentials cached (no password needed)"
    else
        if groups | grep -qE 'wheel|sudo'; then
            echo "✅ User is in sudo/wheel group (can use sudo)"
        else
            echo "❌ User is NOT in sudo/wheel group"
        fi
    fi

    echo

    # Section 5: Common Writable Directories Summary
    echo "SECTION 5: RECOMMENDATIONS"
    echo "--------------------------"
    echo "Personal Data:        $HOME"
    echo "Temporary Files:      /tmp (cleared on reboot)"
    echo "Persistent Temp:      /var/tmp (survives reboot)"
    echo "System Config:        /etc (requires sudo)"
    echo "System Scripts:       /usr/local/bin (requires sudo)"
    echo "System Logs:          /var/log (requires sudo)"
    echo
    echo "Quick Tips:"
    echo "- Test write access: touch /path/to/dir/testfile"
    echo "- Check permissions: ls -ld /path/to/dir"
    echo "- Clear sudo cache: sudo -k"
    echo "- Safe system edit: cp /etc/file ~/file.new && edit && sudo cp ~/file.new /etc/file"

    echo
    echo "========================================"
    echo "Report saved to: $REPORT_FILE"
    echo "========================================"

} | tee $REPORT_FILE

echo
echo "✅ Master analysis complete!"
echo "📄 Report available at: $REPORT_FILE"
EOF

chmod +x ~/master_write_access_check.sh

# Run the master check
./~/master_write_access_check.sh

# View the report
cat ~/access_reports/access_report_*.txt | tail -50