The lab creates the group projects and the users alice (in projects) and bob (not in it), with the password Lab-Pass-1. Work in /srv/dac, which doesn't exist yet. Install the ACL and extended attribute tools (acl, attr) if they're missing.

Tasks

Make /srv/dac/id-suid, a copy of id owned by bob with the setuid bit, so that when alice runs it her effective user is bob. Then remove the owner's execute bit and look at the mode.
Make a shared directory /srv/dac/shared, owned by root and group projects, mode 3770 (setgid and sticky). As alice, create alice.txt in it; add bob to projects and, as bob, create bob.txt and try to delete alice.txt. Then take bob out of projects again.
Make /srv/dac/plan.txt, owned by alice and group projects, mode 640. Give bob read and write access with an ACL, then limit it with the mask so that bob can read the file but not write it.
Give the directory /srv/dac/reports a default ACL that gives bob read and group projects read and write, and create reports/q3.txt in it. Then remove the default ACL again.
Back up the ACLs of reports (recursively) and plan.txt to /srv/dac/acl-backup.txt, clear plan.txt's ACL and restore it from the backup. Copy plan.txt to plain-copy.txt with a plain cp and to full-copy.txt keeping its ACL.
As alice, set the extended attribute user.reviewed to 2026-10-23 on shared/alice.txt. Give id-suid the file capability cap_net_raw (permitted and effective) and find where it's stored. Try the immutable flag on plan.txt, and take it off again.

Hints

cp, chown, chmod 4755, chmod u-x; sudo -u alice ./id-suid; find ... -perm -4000.
install -d -m 3770 -g projects, sudo -u alice touch, usermod -aG, gpasswd -d.
setfacl -m u:bob:rw, setfacl -m m::r, getfacl; sudo -u bob cat.
setfacl -m d:u:bob:r,d:g:projects:rw, setfacl -k.
getfacl -R reports plan.txt > acl-backup.txt, setfacl -b, setfacl --restore=acl-backup.txt (from /srv/dac); cp and cp -a.
setfattr -n user.reviewed -v ..., getfattr -d, getfattr -d -m - -e hex; setcap cap_net_raw=ep, getcap; chattr +i, lsattr, chattr -i.