Loading...

VONDS ©

Lab 31: Special File Permissions

Back to Lab Index

Configure setgid directories for shared work, create a controlled setuid helper, and lock down a world-writable drop zone using the sticky bit. Verify each special permission in real output so you can spot misconfigurations quickly.

permissions users security

Scenario

You are preparing a multi-user development server. The dev team needs a shared workspace that preserves group ownership, a controlled helper that runs with root privileges, and a world-writable staging directory where users cannot delete each other’s files.

Operator context

Special permission bits change how access control behaves at runtime. Set them intentionally and validate state using permission strings and ownership.

Objective

  • Create a shared directory for developers.
  • Apply setgid so new files inherit the dev group.
  • Confirm setgid shows up as s in group perms.
  • Create a root-owned setuid helper safely.
  • Build a world-writable directory protected by sticky bit.
  • Validate special bits using ls output.

Concepts

  • setgid on directories enforces group inheritance for files created within the directory.
  • setuid on executables runs the program with the file owner’s effective UID and is a privilege boundary.
  • sticky bit on a world-writable directory restricts deletion to file owners (or root), even when the directory is writable by everyone.
  • Permission strings reflect special bits using s or t, and map cleanly to the leading octal digit (4, 2, 1).

Walkthrough

Step 1 : Ensure the devs group exists.
Command 
sudo groupadd -f devs

-f keeps the command repeatable by avoiding an error when the group already exists.

Step 2 : Create the shared directory /opt/devshare.
Command 
sudo mkdir -p /opt/devshare

This directory is the shared workspace. Next, assign group ownership and apply setgid so new files inherit the group.

Step 3 : Assign group ownership to devs.
Command 
sudo chgrp devs /opt/devshare

Group ownership is the baseline. setgid controls which group is applied to files created inside the directory.

Step 4 : Apply setgid so new files inherit the group.
Command 
sudo chmod 2775 /opt/devshare

2 sets setgid on the directory. 775 grants full access to owner and group, with read and execute for others. On shared servers, align this with your umask and group policy.

Step 5 : Verify setgid is present.
Command 
ls -ld /opt/devshare
drwxrwsr-x 2 root devs 4096 Jul 19 00:00 /opt/devshare

The group execute slot shows s when setgid is set and group execute is enabled (the rws in the middle).

Step 6 : Create a root-owned helper with setuid.
Safety note

setuid is a privilege escalation mechanism. In production, do not set this on scripts or untrusted binaries. This lab uses /bin/true as a harmless stand-in.

Command 
sudo install -o root -g root -m 4755 /bin/true /usr/local/bin/helper

install copies the file and sets owner, group, and mode in one operation. 4755 applies setuid (4) plus executable permissions.

Step 7 : Confirm setuid is set on the helper.
Command 
ls -l /usr/local/bin/helper
-rwsr-xr-x 1 root root 0 Jul 19 00:00 /usr/local/bin/helper

The owner execute slot shows s when setuid is set and owner execute is enabled (the rws at the front).

Step 8 : Create a world-writable directory protected by sticky bit.
Command 
sudo mkdir -p /tmp/shared && sudo chmod 1777 /tmp/shared

This mirrors the standard /tmp pattern. The directory is writable by everyone, but the sticky bit prevents users from deleting files they do not own.

Step 9 : Confirm sticky bit is set.
Command 
ls -ld /tmp/shared
drwxrwxrwt 2 root root 4096 Jul 19 00:00 /tmp/shared

The last execute slot shows t when sticky bit is set and others execute is enabled (the rwt at the end).

Common breakpoints

setgid not visible in directory permissions

If ls -ld shows drwxrwxr-x instead of drwxrwsr-x, setgid is not set. Re-apply chmod 2775 and confirm group ownership is devs.

setuid shows uppercase S

Uppercase S indicates the special bit is set but the execute bit is not. Confirm the mode is 4755 and that the target is an executable binary.

sticky bit shows uppercase T

Uppercase T indicates sticky is set but others execute is missing. Sticky protection requires the directory to be searchable, so set the mode to 1777.

setuid helper is blocked or unsafe in production

Many environments restrict setuid usage and auditing will flag unexpected setuid binaries. Treat this as a controlled lab artifact and remove it when finished.

Cleanup checklist

Remove the lab artifacts so the system returns to a clean state. This prevents leftover special bits from becoming accidental policy.

Commands 
sudo rm -f /usr/local/bin/helper
sudo rmdir /opt/devshare 2>/dev/null || true
sudo rmdir /tmp/shared 2>/dev/null || true
Success signal

The helper binary is gone, and the directories no longer exist (or are empty and removed). No special bits remain on shared paths you did not intend to keep.

Reference

  • groupadd -f <group> : Creates a group if it does not exist.
    • -f : Do not fail if the group already exists.
  • mkdir -p <dir> : Creates a directory path (including parents).
    • -p : Create parent directories as needed.
  • chgrp <group> <path> : Changes the group owner of a file or directory.
  • chmod 2775 <dir> : Sets setgid on a directory so new files inherit the directory group.
    • 2 : setgid bit (directory group inheritance).
  • chmod 1777 <dir> : Creates a world-writable directory protected by sticky bit.
    • 1 : sticky bit (restricts deletion in a shared directory).
  • install -o root -g root -m 4755 <src> <dst> : Installs a file with specified ownership and mode in one command.
    • -o : Sets owner.
    • -g : Sets group.
    • -m : Sets permissions mode.
    • 4755 : setuid (4) plus standard executable permissions.
  • ls -ld <dir> : Shows directory permissions, including special bits.
    • setgid shows as s in the group execute position (example: drwxrwsr-x).
    • sticky shows as t in the others execute position (example: drwxrwxrwt).
  • ls -l <file> : Shows file permissions, including setuid on executables.
    • setuid shows as s in the owner execute position (example: -rwsr-xr-x).
  • rm -f <path> : Removes a file without prompting.
    • -f : Ignore missing files and never prompt.
  • rmdir <dir> : Removes an empty directory.
    • Fails if the directory is not empty.