8.4 Special Permissions: SUID, SGID & Sticky Bit (104.5)

8.4 Special Permissions: SUID, SGID & Sticky Bit

Quick Summary: While standard Discretionary Access Control (DAC) covers basic read, write, and execute permissions, multi-user Linux environments require advanced permission mechanics. Linux provides three Special Permission Bits: Set-User-ID (SUID), which allows executable binaries to run with the privileges of the file owner; Set-Group-ID (SGID), which allows binaries to run with group privileges and forces directory inheritance for team collaboration; and the Sticky Bit (Restricted Deletion Flag), which prevents users from deleting each other's files in public directories like /tmp. On the LPIC-1 exam, understanding their octal values (4000, 2000, 1000), symbolic representations (s/S, t/T), and auditing with find is critical.

---

1. Architecture of Special Permission Bits

In full 4-digit octal notation, the leading digit represents the special permission flags, followed by User, Group, and Others:

$\text{Mode Format} = [\text{Special}][\text{User}][\text{Group}][\text{Others}]$

Special Bits Value Breakdown:
┌───────────────────────────────────────────────┐
│ Octal Value │ Flag Name  │ Symbolic Representation │
├─────────────┼────────────┼─────────────────────────┤
│    4000     │ SUID       │ u+s (in owner position) │
│    2000     │ SGID       │ g+s (in group position) │
│    1000     │ Sticky Bit │ +t  (in others position)│
└───────────────────────────────────────────────┘

---

2. SUID (Set User ID — Octal 4000 / u+s)

Mechanics on Executable Binaries

Normally, when a user executes a program, the newly spawned process inherits the Real UID and Effective UID of the calling user. When the SUID bit is set on an executable binary, the kernel assigns the process an Effective UID equal to the file's owner, rather than the user who executed it.

# Inspecting /usr/bin/passwd:
$ ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 68208 Aug 29 10:00 /usr/bin/passwd

• The /usr/bin/passwd command is owned by root and has SUID (rws) enabled.
• When an unprivileged user executes passwd to change their password, the process executes with effective root privileges.
• This allows the program to modify the protected /etc/shadow file, which regular users cannot write to directly.

Lowercase s vs. Uppercase S in SUID

⚠️ LPIC-1 Trap — Shell Scripts and SUID: In modern Linux, the kernel ignores the SUID bit on interpreted shell scripts (such as Bash, Perl, or Python scripts) due to severe security race conditions (/dev/fd spoofing). SUID is honored only on compiled ELF binary executables. Furthermore, mounting a filesystem with -o nosuid disables all SUID execution on that partition.

---

3. SGID (Set Group ID — Octal 2000 / g+s)

1. SGID on Executable Binaries

Similar to SUID, an executable binary with SGID executes with the Effective Group ID (EGID) of the file's group owner, granting the process access to group-restricted files or hardware (e.g., /usr/bin/wall running with tty group privileges).

2. SGID on Collaborative Directories (Exam Hotspot)

In shared team environments, multiple users need to collaborate within a common directory. By default, when a user creates a new file, it belongs to that user's primary group, preventing teammates from modifying it.

When the SGID bit is applied to a directory (chmod g+s or chmod 2775):

1. Any new file created inside the directory automatically inherits the Group Owner of the parent directory, rather than the primary group of the creating user.
2. Any new subdirectory created inside automatically inherits both the parent's group owner and the SGID bit.

# Creating a collaborative shared team directory:
$ sudo mkdir /srv/devteam
$ sudo chown :developers /srv/devteam
$ sudo chmod 2775 /srv/devteam

# Verification of directory permissions:
$ ls -ld /srv/devteam
drwxrwsr-x 2 root developers 4096 Aug 29 10:00 /srv/devteam

Lowercase s vs. Uppercase S in SGID

• s (lowercase): SGID bit is set AND group execute (x) is enabled (rwxrwsr-x / 2775).
• S (uppercase): SGID bit is set, but group execute (x) is disabled (rwxrWsr-x / 2765).

---

4. The Sticky Bit (Restricted Deletion — Octal 1000 / +t / o+t)

Mechanics on Public Directories

In public multi-user directories like /tmp and /var/tmp, all system users require write (w) and execute (x) permissions to create temporary working files (mode 777). However, standard DAC rules would permit any user to delete or rename any other user's files.

The Sticky Bit (restricted deletion flag) solves this vulnerability. When set on a directory:

• Users can still create files freely.
• A file inside the directory can ONLY be deleted or renamed by:
  1. The User Owner of the file.
  2. The Owner of the directory (typically root).
  3. The Root superuser.

# Inspecting /tmp:
$ ls -ld /tmp
drwxrwxrwt 18 root root 4096 Aug 29 10:00 /tmp

Lowercase t vs. Uppercase T in Sticky Bit

• t (lowercase): Sticky bit is set AND others execute (x) is enabled (rwxrwxrwt / 1777).
• T (uppercase): Sticky bit is set, but others execute (x) is disabled (rwxrwxrwT / 1776).

---

5. Practical Configuration & Special Permission Auditing

Setting Special Permissions via chmod

Auditing Special Permissions with find

Auditing SUID and SGID files is a crucial security maintenance task tested heavily on the LPIC-1 exam:

# 1. Find all files with SUID bit set (-perm -4000):
$ sudo find / -type f -perm -4000 -ls 2>/dev/null

# 2. Find all files with SGID bit set (-perm -2000):
$ sudo find / -type f -perm -2000 -ls 2>/dev/null

# 3. Find all directories with the Sticky Bit set (-perm -1000):
$ sudo find / -type d -perm -1000 -ls 2>/dev/null

# 4. Find all files with EITHER SUID or SGID set (-perm /6000 or -perm /u=s,g=s):
$ sudo find / -type f -perm /6000 2>/dev/null

💡 LPIC-1 Exam Fill-in-the-Blank Alert: What find argument syntax searches for all files that have at least the SUID permission bit set, regardless of what other permissions are enabled? Answer: -perm -4000 (or -perm /4000)