Setuid, setgid, and stickybit Permissions

Each file has an owner, indicating who created the file. At the same time, the file also has a group number, indicating the group to which the file belongs, generally the group to which the file owner belongs.

If it is an executable file, the file generally only has the permission of the user who calls the file, while setuid and setgid can change this setting.

Setuid: set to grant the file owner permissions during execution. the typical file is/usr/bin/passwd. if a common user executes the file, the file can obtain the root permission during execution, so that the user's password can be changed.

Setgid: this permission is only valid for the directory. After the directory is set to this bit, any files created in this directory have the same group as the directory.

Sticky Bit: This bit can be understood as a non-delete bit. whether a file can be deleted by a user depends on whether the file group has the write permission on the user. if you do not have the write permission, all files in this directory cannot be deleted or new files cannot be added. if you want to add a file but cannot delete the file at the same time, you can use the sticky bit for the file. after this bit is set, the file cannot be deleted even if the user has the write permission on the directory.

The following describes how to operate these labels:

Operate these logos and operationsCompositionCommands with the same permissions are all CHMOD. There are two methods to operate,

1) chmod U + S temp -- add the setuid flag to the temp file. (setuid is only valid for the file)

Chmod g + S tempdir -- add the setgid flag to the tempdir directory (setgid is only valid for the Directory)

Chmod o + T temp -- add the sticky flag to the temp file (sticky is only valid for the file)

2) The octal mode is used. Three Octal numbers are used to mark general files, such as 666,777,644. If you set these features? Too many ?, A group of Octal numbers, such as 4666,277 7, are added to this group of numbers. The meanings of the Octal numbers are as follows,

ABC

A-setuid bit. If this bit is 1, setuid is set.

B-setgid bit. If this bit is 1, setgid is set.

C-sticky bit. If this bit is 1, sticky is set.

After these flags are set, you can use LS-L to view them. If these flags exist, they will be displayed in the original execution flags. For example:

Rwsrw-r -- indicates that the setuid flag exists.

Rwxrwsrw-indicates that the setgid flag exists.

Rwxrw-rwt indicates sticky flag

So where did the original execution mark x go? The system stipulates that, if there is X in this bit, these special signs will be displayed as lowercase letters (S, S, T ). otherwise, uppercase letters (S, S, T) are displayed)