ObjectiveGetting to know how special permissions works, how to identify and set them.
- Knowledge of the standard unix/linux permissions system
- # - requires given linux commands to be executed with root privileges either directly as a root user or by use of
- $ - requires given linux commands to be executed as a regular non-privileged user
IntroductionNormally, on a unix-like operating system, the ownership of files and directories is based on the default
gid(group-id) of the user who created them. The same thing happens when a process is launched: it runs with the effective user-id and group-id of the user who started it, and with the corresponding privileges. This behavior can be modified by using special permissions.
The setuid bitWhen the
setuidbit is used, the behavior described above it's modified so that when an executable is launched, it does not run with the privileges of the user who launched it, but with that of the file owner instead. So, for example, if an executable has the
setuidbit set on it, and it's owned by root, when launched by a normal user, it will run with root privileges. It should be clear why this represents a potential security risk, if not used correctly.
An example of an executable with the setuid permission set is
passwd, the utility we can use to change our login password. We can verify that by using the
ls -l /bin/passwd -rwsr-xr-x. 1 root root 27768 Feb 11 2017 /bin/passwdHow to identify the
setuidbit? As you surely have noticed looking at the output of the command above, the
setuidbit is represented by an
sin place of the
xof the executable bit. The
simplies that the executable bit is set, otherwise you would see a capital
S. This happens when the
setgidbits are set, but the executable bit is not, showing the user an inconsistency: the
setgitbits have no effect if the executable bit is not set. The setuid bit has no effect on directories.
The setgid bitUnlike the
setgidbit has effect on both files and directories. In the first case, the file which has the
setgidbit set, when executed, instead of running with the privileges of the group of the user who started it, runs with those of the group which owns the file: in other words, the group ID of the process will be the same of that of the file.
When used on a directory, instead, the
setgidbit alters the standard behavior so that the group of the files created inside said directory, will not be that of the user who created them, but that of the parent directory itself. This is often used to ease the sharing of files (files will be modifiable by all the users that are part of said group). Just like the setuid, the setgid bit can easily be spotted (in this case on a test directory):
ls -ld test drwxrwsr-x. 2 egdoc egdoc 4096 Nov 1 17:25 testThis time the
sis present in place of the executable bit on the group sector.
The sticky bitThe sticky bit works in a different way: while it has no effect on files, when used on a directory, all the files in said directory will be modifiable only by their owners. A typical case in which it is used, involves the
/tmpdirectory. Typically this directory is writable by all users on the system, so to make impossible for one user to delete the files of another one, the sticky bit is set:
$ ls -ld /tmp drwxrwxrwt. 14 root root 300 Nov 1 16:48 /tmpIn this case the owner, the group, and all other users, have full permissions on the directory (read, write and execute). The sticky bit is identifiable by a
twhich is reported where normally the executable
xbit is shown, in the "other" section. Again, a lowercase
timplies that the executable bit is also present, otherwise you would see a capital
How to set special bitsJust like normal permissions, the special bits can be assigned with the
chmodcommand, using the numeric or the
ugo/rwxformat. In the former case the
stickybits are represented respectively by a value of 4, 2 and 1. So for example if we want to set the
setgidbit on a directory we would execute:
$ chmod 2775 testWith this command we set the
setgidbit on the directory, (identified by the first of the four numbers), and gave full privileges on it to it's owner and to the user that are members of the group the directory belongs to, plus read and execute permission for all the other users (remember the execute bit on a directory means that a user is able to
cdinto it or use
lsto list its content).
The other way we can set the special permissions bits is to use the ugo/rwx syntax:
$ chmod g+s testTo apply the
setuidbit to a file, we would have run:
$ chmod u+s fileWhile to apply the sticky bit:
$ chmod o+t testThe use of special permissions can be very useful in some situations, but if not used correctly the can introduce serious vulnerabilities, so think twice before using them.