Special permissions (setuid, setgid, sticky bit) in Linux CLI - Step-by-Step Execution

Concept Flow - Special permissions (setuid, setgid, sticky bit)

Start

↓

Check file permissions

↓

Is setuid bit set?

Yes→Run file with owner's permissions

↓

Execute normally

↓

Is setgid bit set?

Yes→Run file with group's permissions

↓

Execute normally

↓

Is sticky bit set?

Yes→Restrict deletion in directory

↓

Normal deletion rules

↓

End

This flow shows how Linux checks special permission bits on files or directories and changes behavior accordingly.

Execution Sample

Linux CLI

ls -l /usr/bin/passwd
chmod u+s /usr/bin/passwd
ls -l /usr/bin/passwd

Shows the setuid bit on the passwd command, then sets it and shows the change.

Execution Table

Step	Command	Action	Output Example	Effect
1	ls -l /usr/bin/passwd	Check current permissions	-rwxr-xr-x 1 root root 54256 Apr 10 12:00 /usr/bin/passwd	No special bits set
2	chmod u+s /usr/bin/passwd	Set setuid bit		Setuid bit added
3	ls -l /usr/bin/passwd	Check permissions again	-rwsr-xr-x 1 root root 54256 Apr 10 12:00 /usr/bin/passwd	s in user execute means setuid active
4	Run /usr/bin/passwd as normal user	Execute file	Runs with root permissions	User temporarily has root rights for this program
5	chmod g+s /some/dir	Set setgid bit on directory		New files inherit group ownership
6	chmod +t /tmp	Set sticky bit on directory		Only owner can delete files inside
7	ls -ld /tmp	Check sticky bit	drwxrwxrwt 10 root root 4096 Apr 10 12:00 /tmp	t at end means sticky bit set
8	Try deleting file owned by another user in /tmp	Attempt deletion	Permission denied	Sticky bit prevents deletion by others
9	Exit			End of demonstration

💡 Demonstration ends after showing effects of setuid, setgid, and sticky bit.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	After Step 6
/usr/bin/passwd permissions	-rwxr-xr-x	-rwsr-xr-x	-rwsr-xr-x	-rwsr-xr-x	-rwsr-xr-x
/some/dir permissions	drwxr-xr-x	drwxr-xr-x	drwxr-xr-x	drwxr-sr-x	drwxr-sr-x
/tmp permissions	drwxrwxrwx	drwxrwxrwx	drwxrwxrwx	drwxrwxrwx	drwxrwxrwt

Key Moments - 3 Insights

Why does the 's' appear in the user execute position after setting setuid?

The 's' replaces the 'x' in the user execute position to show setuid is active, as seen in execution_table step 3.

How does the sticky bit prevent file deletion in a directory?

Sticky bit restricts deletion to file owners or root, so others cannot delete files even if they have write permission on the directory, shown in step 8.

What effect does setgid have on a directory?

Setgid on a directory makes new files inherit the directory's group ownership, as shown in step 5.

Visual Quiz - 3 Questions

Look at the execution table at step 3, what does the 's' in '-rwsr-xr-x' mean?

A Sticky bit is set, file cannot be deleted

B Setuid bit is set, file runs with owner's permissions

C Setgid bit is set, file runs with group's permissions

D No special permissions are set

💡 Hint

Check the 'Action' and 'Effect' columns in step 3 of the execution_table.

At which step does the sticky bit get set on the /tmp directory?

A Step 2

B Step 5

C Step 6

D Step 8

💡 Hint

Look for the command 'chmod +t /tmp' in the execution_table.

If you remove the setgid bit from /some/dir, what changes in the variable_tracker?

A The group permissions on /some/dir change to 'drwxr-xr-x'

B The user permissions on /usr/bin/passwd change

C The sticky bit on /tmp is removed

D Nothing changes

💡 Hint

Check the '/some/dir permissions' row in variable_tracker after step 5.

Concept Snapshot

Special permissions in Linux modify file or directory behavior:
- setuid (user execute 's'): runs file as owner
- setgid (group execute 's'): runs file as group or sets group on new files in dir
- sticky bit ('t' on dir): restricts file deletion to owners
Use chmod u+s, g+s, +t to set these bits.
Check with ls -l (look for s or t in permissions).

Full Transcript

This lesson shows how Linux special permissions setuid, setgid, and sticky bit work. First, we check a file's permissions with ls -l. Then we set the setuid bit using chmod u+s, which changes the user execute permission to 's'. This means when the file runs, it runs with the file owner's permissions, not the user's. Next, we set the setgid bit on a directory with chmod g+s, so new files inherit the directory's group. Finally, we set the sticky bit on a directory with chmod +t, which prevents users from deleting files they do not own inside that directory. We verify these changes with ls -l and test effects like permission denied on deletion. The visual tables track permission changes step-by-step and explain how these bits affect file and directory behavior.

Practice

1. What does the setuid permission do on an executable file?

easy

A. Runs the program with the file owner's permissions

B. Allows anyone to delete the file

C. Makes new files inherit the folder's group

D. Prevents the file from being executed

Solution

1. Step 1: Understand setuid purpose

   The setuid permission allows a program to run with the permissions of the file owner, not the user running it.

2. Step 2: Compare options with setuid behavior

   Only Runs the program with the file owner's permissions correctly describes this behavior; others describe different permissions or incorrect effects.

3. Final Answer:

   Runs the program with the file owner's permissions -> Option A

4. Quick Check:

   setuid = runs as owner [OK]

Hint: Setuid means run as file owner, not current user [OK]

Common Mistakes:

• Confusing setuid with sticky bit
• Thinking setuid changes file deletion rights
• Mixing setuid with setgid effects

2. Which command correctly sets the setgid bit on a directory named shared?

easy

A. chmod g+s shared

B. chmod +s shared

C. chmod u+s shared

D. chmod o+s shared

Solution

1. Step 1: Identify correct chmod syntax for setgid

   The setgid bit is set using g+s with chmod on directories.

2. Step 2: Verify options

   chmod g+s shared uses chmod g+s shared, which is correct. Other options use incorrect flags or users.

3. Final Answer:

   chmod g+s shared -> Option A

4. Quick Check:

   Setgid = chmod g+s [OK]

Hint: Setgid uses 'g+s' with chmod on directories [OK]

Common Mistakes:

• Using '+s' without user class
• Confusing setuid (u+s) with setgid
• Trying to set setgid on files with wrong syntax

3. Given a directory /tmp/shared with permissions drwxrwxrwt, what does the t at the end signify?

medium

A. Setuid bit is set

B. Sticky bit is set

C. Setgid bit is set

D. No special permissions set

Solution

1. Step 1: Interpret permission string ending with 't'

   The 't' at the end of directory permissions indicates the sticky bit is set.

2. Step 2: Match 't' with sticky bit meaning

   The sticky bit prevents users from deleting files they don't own in that directory.

3. Final Answer:

   Sticky bit is set -> Option B

4. Quick Check:

   't' at end = sticky bit [OK]

Hint: 't' at end of permissions means sticky bit set [OK]

Common Mistakes:

• Confusing 't' with setuid or setgid
• Thinking 't' means no special permission
• Misreading permissions string

4. You set the setuid bit on a script using chmod u+s script.sh, but it doesn't run with owner permissions. What is the likely problem?

medium

A. You need to set the sticky bit instead

B. The file owner must be root for setuid to work

C. The script is a shell script and setuid does not work on scripts

D. You forgot to set execute permission

Solution

1. Step 1: Understand setuid behavior on scripts

   Most Linux systems ignore setuid on shell scripts for security reasons.

2. Step 2: Evaluate other options

   Sticky bit is unrelated, owner need not be root, and execute permission is usually set if script runs.

3. Final Answer:

   The script is a shell script and setuid does not work on scripts -> Option C

4. Quick Check:

   Setuid ignored on scripts [OK]

Hint: Setuid rarely works on scripts, only on binaries [OK]

Common Mistakes:

• Assuming setuid works on all files
• Confusing sticky bit with setuid
• Not checking execute permission

5. You want to create a shared directory /data/shared where all files created inside inherit the directory's group and users cannot delete others' files. Which commands set this up correctly?

hard

A. chmod 2777 /data/shared && chmod g+s /data/shared

B. chmod 777 /data/shared && chmod g+s /data/shared

C. chmod 2777 /data/shared

D. chmod 2777 /data/shared && chmod +t /data/shared

Solution

1. Step 1: Set setgid and sticky bit on directory

   Setgid (2) makes new files inherit group; sticky bit (1) prevents deleting others' files.

2. Step 2: Analyze commands

   chmod 2777 /data/shared && chmod +t /data/shared sets permissions to 2777 (setgid + rwxrwxrwx) and adds sticky bit with chmod +t. This correctly applies both.

3. Final Answer:

   chmod 2777 /data/shared && chmod +t /data/shared -> Option D

4. Quick Check:

   Setgid + sticky bit = chmod 2777 + t [OK]

Hint: Setgid=2xxx, sticky=1xxx; combine for shared dir [OK]

Common Mistakes:

• Using sticky bit without setgid
• Confusing octal codes for permissions
• Setting wrong permission order