Paranoid Penguin - Linux Filesystem Security, Part II
Last time, we looked at file and directory permissions from the ground up—what users and groups are and how to set and remove read, write and execute permissions on files and directories. In this column, we look at some more advanced types of permissions, explore permission numeric modes and the command umask and see how to delegate root's authority with su and sudo. This article contains more intermediate-level information than last month's, but hopefully it should make sense, even if all you know about permissions is what you read here last time.
Recall last month's long listing of the extreme_casseroles/ directory:
drwxr-x--- 8 biff drummers 288 Mar 25 01:38 extreme_casseroles
Recall also that we set the group permissions on this directory to r-x, that is, group-readable and group-executable, so that our fellow members of the drummers group could enter this directory and enjoy the recipes stored therein.
Suppose that our drummer friend Biff wants to allow his fellow drummers not only to read his recipes but to add their own as well. As we saw last time, all he needs to do is set the group-write bit for this directory, like this:
chmod g+w ./extreme_casseroles
There's only one problem with doing that, however. Write permissions include both the ability to create new files in this directory and also to delete them. What's to stop one of his drummer pals from deleting other people's recipes? The sticky bit, that's what.
In olden times, the sticky bit was used to write a file (program) to memory so it would load more quickly when invoked. On Linux, however, it serves a different function. When you set the sticky bit on a directory, it limits people's ability to delete things in that directory. That is, to delete a given file in the directory you either must own that file or own the directory, even if you belong to the group that owns the directory and group-write permissions are set on it.
To set the sticky bit, issue the command:
chmod +t directory_name
In our example, this would be chmod +t extreme_casseroles. If we now do a long listing of the directory itself, by using ls with the -d option to list the directory's permissions rather than its contents, that is, ls -ld extreme_casseroles, we see:
drwxrwx--T 8 biff drummers 288 Mar 25 01:38 extreme_casseroles
Notice the T at the end of the permissions. We'd normally expect to see either x or - there, depending on whether the directory is other-writable. The T denotes that the directory is not other-executable and has the sticky bit set. A lowercase t would denote that the directory is other-executable and has the sticky bit set.
To illustrate what effect this restriction has, suppose a listing of the contents of extreme_casseroles/ looks like Listing 1.
Listing 1. Contents of extreme_casseroles/
drwxrwxr-T 3 biff drummers 192 2004-08-10 23:39 . drwxr-xr-x 3 biff drummers 4008 2004-08-10 23:39 .. -rw-rw-r-- 1 biff drummers 18 2004-07-08 07:40 chocolate_turkey_casserole.txt -rw-rw-r-- 1 biff drummers 12 2004-08-08 15:10 pineapple_mushroom_surprise.txt drwxr-xr-x 2 biff drummers 80 2004-08-10 23:28 src
Suppose further that the user crash tries to delete the file pineapple_mushroom_surprise.txt, which crash finds offensive. crash expects this to work, because he belongs to the group drummers and the group-write bit is set on this file. Remember, though, that biff set the parent directory's sticky bit. Therefore, crash's attempted deletion fails, as we see in Listing 2.
Listing 2. Attempting Deletion with Sticky Bit Set
crash> rm pineapple_mushroom_surprise.txt rm: cannot remove `pineapple_mushroom_surprise.txt': Operation not permitted
One more note on the sticky bit: it only applies to the directory's first level downward. In Listing 1, you may have noticed that besides the two nasty recipes, extreme_casseroles/ also contains another directory, src. The contents of src will not be affected by extreme_casseroles' sticky bit, although the directory src itself is. If biff wants to protect src's contents from group deletion, he needs to set src's own sticky bit.
|Using Salt Stack and Vagrant for Drupal Development||May 20, 2013|
|Making Linux and Android Get Along (It's Not as Hard as It Sounds)||May 16, 2013|
|Drupal Is a Framework: Why Everyone Needs to Understand This||May 15, 2013|
|Home, My Backup Data Center||May 13, 2013|
|Non-Linux FOSS: Seashore||May 10, 2013|
|Trying to Tame the Tablet||May 08, 2013|
- Using Salt Stack and Vagrant for Drupal Development
- Making Linux and Android Get Along (It's Not as Hard as It Sounds)
- New Products
- Validate an E-Mail Address with PHP, the Right Way
- Drupal Is a Framework: Why Everyone Needs to Understand This
- A Topic for Discussion - Open Source Feature-Richness?
- New Products
- New Products
- The Pari Package On Linux
- Dart: a New Web Programming Experience
- This is the easiest tutorial
2 hours 7 min ago
- Ahh, the Koolaid.
7 hours 46 min ago
- git-annex assistant
13 hours 45 min ago
- direct cable connection
14 hours 8 min ago
- Agreed on AirDroid. With my
14 hours 18 min ago
- I just learned this
14 hours 22 min ago
14 hours 52 min ago
- not living upto the mobile revolution
17 hours 43 min ago
- Deceptive Advertising and
18 hours 19 min ago
- Let\'s declare that you have
18 hours 20 min ago
Enter to Win an Adafruit Prototyping Pi Plate Kit for Raspberry Pi
It's Raspberry Pi month at Linux Journal. Each week in May, Adafruit will be giving away a Pi-related prize to a lucky, randomly drawn LJ reader. Winners will be announced weekly.
Fill out the fields below to enter to win this week's prize-- a Prototyping Pi Plate Kit for Raspberry Pi.
Congratulations to our winners so far:
- 5-8-13, Pi Starter Pack: Jack Davis
- 5-15-13, Pi Model B 512MB RAM: Patrick Dunn
- Next winner announced on 5-21-13!
Free Webinar: Linux Backup and Recovery
Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.
In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.