Prevent malicious deletion of files by sticking bits in Unix

Article Title: Unix uses sticking bits to prevent malicious deletion of files. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

An enterprise sometimes forms a project team to complete a specific project. In this case, the project team requires members of each project team to have the read and write permissions for a directory. They can create files in this directory and read files created by others. However, there is a restriction that files created by others cannot be deleted. As shown in, the system engineer has now created an item directory for a specific project. There are two files in this directory: urr001 and tgt001, which are created by the user SA01 and the user SA02 respectively. The enterprise requires that files can be created in both user SA01 and user SA02. SA01 can also read files of tgt001 (with the ownership of SA02; however, SA01 cannot delete the tgt001 file.

Maybe System engineers may be skeptical about this requirement. Can this be achieved? The answer is yes. This function can be easily implemented through the adhesion bit function provided by the Unix operating system.

　1. Relationship between the adhesion position and the file.

The stick bit, also known as the Save text bit, is actually a permission control attribute. In general, the adhesive bit can be used on a common file or a directory file. When used in a common file, the sticking bit can set the SUID of a program file. And its text image will be permanently stored in the SWAp area. In this case, the program can be quickly loaded into the memory when it obtains the CPU usage right. Therefore, the sticking position can improve the running efficiency of the system program. For example, in some versions of Unix systems, the sticking bit of commonly used program files such as vi is set to 1, which significantly improves the running efficiency of these applications. However, this feature is rarely used now. Because the disk read and write speed has reached the extreme, and the memory price is also low. That is to say, the disk speed and memory are usually not the bottleneck resources of the system, so it is no longer necessary to set the adhesion bit for common files. Therefore, in the system settings, I basically do not set a sticking bit for common files.

So isn't the stick position useless? Actually not. Although setting the adhesion bit on a common file has no practical application value, setting the adhesion bit on the directory file is still very useful. For example, the content described by the author at the beginning of the article needs to be achieved through the adhesion position. To put it simply, when the bits are combined with directory files, some unexpected security measures can be implemented.

[1] [2] [3] Next page