Special permissions (setuid, setgid, sticky bit) in Linux CLI - Mini Project: Build & Apply

Understanding Special Permissions: setuid, setgid, and sticky bit

📖 Scenario: You are a system administrator managing a shared Linux server. You need to understand how special permissions like setuid, setgid, and the sticky bit work to control access and security on files and directories.

🎯 Goal: Learn how to set and verify special permissions setuid, setgid, and sticky bit on files and directories using Linux commands.

📋 What You'll Learn

Create a test file and a test directory

Set the setuid permission on the test file

Set the setgid permission on the test directory

Set the sticky bit on the test directory

Verify the special permissions using ls -l

💡 Why This Matters

🌍 Real World

System administrators use special permissions to control how users can execute files and manage shared directories securely.

💼 Career

Understanding and managing special permissions is essential for Linux system administrators and security professionals to maintain system integrity and user access control.

1

Create a test file and a test directory

Create a file called testfile and a directory called testdir using Linux commands.

Linux CLI

# Create a file named testfile
# Create a directory named testdir

Hint

Use touch to create an empty file and mkdir to create a directory.

2

Set the setuid permission on the test file

Use the chmod command to set the setuid permission on the file testfile.

Linux CLI

touch testfile
mkdir testdir
# Set setuid permission on testfile

Hint

Use chmod u+s filename to set the setuid bit on a file.

3

Set the setgid permission on the test directory

Use the chmod command to set the setgid permission on the directory testdir.

Linux CLI

touch testfile
mkdir testdir
chmod u+s testfile
# Set setgid permission on testdir

Hint

Use chmod g+s directoryname to set the setgid bit on a directory.

4

Set the sticky bit on the test directory and verify all permissions

Use the chmod command to set the sticky bit on the directory testdir. Then use ls -l to display the permissions of testfile and testdir.

Linux CLI

touch testfile
mkdir testdir
chmod u+s testfile
chmod g+s testdir
# Set sticky bit on testdir
# List permissions of testfile and testdir

Hint

Use chmod +t directoryname to set the sticky bit. Use ls -l to check permissions. Look for s in the user or group permissions and t at the end for sticky bit.

Practice

1. What does the setuid permission do on an executable file?

easy

A. Runs the program with the file owner's permissions

B. Allows anyone to delete the file

C. Makes new files inherit the folder's group

D. Prevents the file from being executed

Solution

1. Step 1: Understand setuid purpose

   The setuid permission allows a program to run with the permissions of the file owner, not the user running it.

2. Step 2: Compare options with setuid behavior

   Only Runs the program with the file owner's permissions correctly describes this behavior; others describe different permissions or incorrect effects.

3. Final Answer:

   Runs the program with the file owner's permissions -> Option A

4. Quick Check:

   setuid = runs as owner [OK]

Hint: Setuid means run as file owner, not current user [OK]

Common Mistakes:

• Confusing setuid with sticky bit
• Thinking setuid changes file deletion rights
• Mixing setuid with setgid effects

2. Which command correctly sets the setgid bit on a directory named shared?

easy

A. chmod g+s shared

B. chmod +s shared

C. chmod u+s shared

D. chmod o+s shared

Solution

1. Step 1: Identify correct chmod syntax for setgid

   The setgid bit is set using g+s with chmod on directories.

2. Step 2: Verify options

   chmod g+s shared uses chmod g+s shared, which is correct. Other options use incorrect flags or users.

3. Final Answer:

   chmod g+s shared -> Option A

4. Quick Check:

   Setgid = chmod g+s [OK]

Hint: Setgid uses 'g+s' with chmod on directories [OK]

Common Mistakes:

• Using '+s' without user class
• Confusing setuid (u+s) with setgid
• Trying to set setgid on files with wrong syntax

3. Given a directory /tmp/shared with permissions drwxrwxrwt, what does the t at the end signify?

medium

A. Setuid bit is set

B. Sticky bit is set

C. Setgid bit is set

D. No special permissions set

Solution

1. Step 1: Interpret permission string ending with 't'

   The 't' at the end of directory permissions indicates the sticky bit is set.

2. Step 2: Match 't' with sticky bit meaning

   The sticky bit prevents users from deleting files they don't own in that directory.

3. Final Answer:

   Sticky bit is set -> Option B

4. Quick Check:

   't' at end = sticky bit [OK]

Hint: 't' at end of permissions means sticky bit set [OK]

Common Mistakes:

• Confusing 't' with setuid or setgid
• Thinking 't' means no special permission
• Misreading permissions string

4. You set the setuid bit on a script using chmod u+s script.sh, but it doesn't run with owner permissions. What is the likely problem?

medium

A. You need to set the sticky bit instead

B. The file owner must be root for setuid to work

C. The script is a shell script and setuid does not work on scripts

D. You forgot to set execute permission

Solution

1. Step 1: Understand setuid behavior on scripts

   Most Linux systems ignore setuid on shell scripts for security reasons.

2. Step 2: Evaluate other options

   Sticky bit is unrelated, owner need not be root, and execute permission is usually set if script runs.

3. Final Answer:

   The script is a shell script and setuid does not work on scripts -> Option C

4. Quick Check:

   Setuid ignored on scripts [OK]

Hint: Setuid rarely works on scripts, only on binaries [OK]

Common Mistakes:

• Assuming setuid works on all files
• Confusing sticky bit with setuid
• Not checking execute permission

5. You want to create a shared directory /data/shared where all files created inside inherit the directory's group and users cannot delete others' files. Which commands set this up correctly?

hard

A. chmod 2777 /data/shared && chmod g+s /data/shared

B. chmod 777 /data/shared && chmod g+s /data/shared

C. chmod 2777 /data/shared

D. chmod 2777 /data/shared && chmod +t /data/shared

Solution

1. Step 1: Set setgid and sticky bit on directory

   Setgid (2) makes new files inherit group; sticky bit (1) prevents deleting others' files.

2. Step 2: Analyze commands

   chmod 2777 /data/shared && chmod +t /data/shared sets permissions to 2777 (setgid + rwxrwxrwx) and adds sticky bit with chmod +t. This correctly applies both.

3. Final Answer:

   chmod 2777 /data/shared && chmod +t /data/shared -> Option D

4. Quick Check:

   Setgid + sticky bit = chmod 2777 + t [OK]

Hint: Setgid=2xxx, sticky=1xxx; combine for shared dir [OK]

Common Mistakes:

• Using sticky bit without setgid
• Confusing octal codes for permissions
• Setting wrong permission order