Skip to content
Clairos Learn

CLI and workspace hygiene · Lesson 4 of 12 · 8 min

Protect local configuration

Configuration containing credentials needs an appropriate local permission boundary. In this exercise mode 600 gives the owner read/write access and no group or other access.

Open the labCourse map
Mastery 0/3Run itExplain itApply it
learner@clairosSimulated AI Ops lab
learner@clairos:~ $
↑ history · Tab complete · Ctrl+C cancel · Esc, Tab to leaveExit 0

Understand the pattern

Configuration containing credentials needs an appropriate local permission boundary. In this exercise mode 600 gives the owner read/write access and no group or other access.

Interpret the evidence

Restrict this private configuration file to mode 600 after confirming the owner.

A tempting mistake

Use mode 777 to solve every access issue.

All names, measurements, prices, versions, and thresholds in this exercise are fictional training data. The evidence supports this bounded scenario, not a claim about a live provider.

Worked example and expected result
$ cat /opt/ai-lab/cases/aiops-cli-workspace-004.json
{
  "fixture": "Fictional training data; not a live measurement.",
  "file": "runtime.env",
  "owner": "learner",
  "mode": "644",
  "target_mode": "600"
}

Exit status: 0. The command completed successfully in the training fixture.

$ jq .target_mode /opt/ai-lab/cases/aiops-cli-workspace-004.json
"600"

Exit status: 0. The command completed successfully in the training fixture.

$ printf '%s\n' 'restrict-mode' > /home/learner/lab/aiops-cli-workspace-004-decision.txt
(no output; exit 0)

Exit status: 0. The command completed successfully in the training fixture.

Try a variation

Name the assumption that would have to change for “restrict-mode” to stop being the justified action. Do not silently replace missing evidence with a guess.

Explain it

What does the evidence in “Protect local configuration” justify?

Apply it elsewhere

A colleague concludes: “Use mode 777 to solve every access issue.” What should you do?

Keep the momentum.

Complete the lab, then explain and apply the pattern.

Next: Name files predictablyTry an incident drill

Anonymous lesson and mastery progress lasts for this session. Sign in to keep synced lesson XP between sessions; mastery stays device-local. No speed bonus, lost lives, or hint penalties.

Keep learning

  1. 01Inspect redacted environment dataRedacted configuration proves which keys are present without revealing their values. A redaction marker is not a credential and should not be pasted into an authentication request.Practice
  2. 02Name files predictablyPredictable filenames let another operator relate a note to a case and version. Names should describe what was captured without embedding secrets or sensitive user content.Practice
  3. 03Compare a configuration copyCompare the intended configuration with the candidate before activation. A one-line change can still alter behavior substantially, so read the value and its context.Practice

Case methodology: evidence, limits, decision