difference between setuid , setgid and stickbit

General support questions
Post Reply
knzzz
Posts: 157
Joined: 2017/02/25 12:41:42

difference between setuid , setgid and stickbit

Post by knzzz » 2019/01/15 11:54:49

Hi Team,

can some one please explain me setuid. setgid and stickybit in files and folders explain to me with example ?

Regards
Kanna

MartinR
Posts: 714
Joined: 2015/05/11 07:53:27
Location: UK

Re: difference between setuid , setgid and stickbit

Post by MartinR » 2019/01/15 12:35:27

setuid - If the user has the right to run the file, then for the duration of the run the effective UID is is the owner of the file. For example /usr/bin/passwd has the permission string rwsr-xr-x and is owned by root. Any user can execute the program due to the user mode r-x. When running the code, for instance to change your password, you are effectively running as root and can therefore update /etc/shadow which would otherwise be forbidden. Only trusted code should ever have this bit set, the program itself has to implement any security restrictions (such as stopping you changing my password) itself.

setguid - If the user has the right to run the file, then for the duration of the run the effective GID is the GID of the file. This is much rarer than suid, and is usually only found within collaborative applications where there is a requirement to update state or log files. It is so rare that I haven't found an example on my system after a quick look!

stickybit - (1) Files - The original use of the stickybit was in small memory UNIX machines. Due to the small memory present, as soon as an application closed it's text (the actual fixed code) memory the memory would be released and overwritten. If the system manager was aware that a particular application was being repeatedly run he could set the stickybit and the code would remain stuck in memory. This gave faster activations and reduced disk usage at the cost of reduced general memory availability. I've not seen this done in years, modern large memory systems have efficient caching mechanisms that achieve a similar effect.

stickybit - (2) Directories - When applied to directories the stickybit is correctly called the "restricted deletion flag" (though no-one ever does). If set on a directory a user who would otherwise be able to delete a file therein is only able to if they either (i) own the file or (ii) own the directory. The usual place this is found is on /tmp. If I create a file /tmp/teaclub.txt, with mode rw-r--r--, then because you have write access to /tmp you could rename or delete it. However if the stickybit is set on /tmp: rwxrwxrwt then you are not permitted to delete it, only I can.

dunch
Posts: 66
Joined: 2018/11/07 13:48:53
Location: Yorkshire

Re: difference between setuid , setgid and stickbit

Post by dunch » 2019/01/15 13:41:14

A good and comprehensive description from Martin but it's worth mentioning that the sticky bit on files is ignored in Linux and most of the modern BSDs.

MartinR
Posts: 714
Joined: 2015/05/11 07:53:27
Location: UK

Re: difference between setuid , setgid and stickbit

Post by MartinR » 2019/01/15 15:10:06

Wow, good catch. I came to CentOS 10 years ago from SuSE, and prior to that UNIX. I suspect that this is the first time I've tested the stickybit on /tmp and you are quite correct! The man page is wrong, see chmod(1):
The restricted deletion flag or sticky bit is a single bit, whose interpretation depends on the file type. For directories, it prevents
unprivileged users from removing or renaming a file in the directory unless they own the file or the directory; this is called the
restricted deletion flag for the directory, and is commonly found on world-writable directories like /tmp.
:oops:

Post Reply