Advanced UNIX Permissions and Security

UNIX file permissions regulate user and process access to files and directories. The basic read, write, and execute bits (rwx) for Owner, Group, and Others provide the foundation of this security model. However, multi-user systems require advanced mechanisms to manage privilege escalation, shared directories, and fine-grained access rules.

Special Permissions: SUID, SGID, and the Sticky Bit

Three special permission bits modify the default access behavior of executables and directories:

Set-User-ID (SUID)

When an executable file has the SUID bit set, a process executing the file assumes the privileges of the file’s owner rather than those of the user running it.

• Use Case: The passwd command requires root access to write to /etc/shadow. Since /usr/bin/passwd is owned by root and has the SUID bit set, ordinary users can run it to change their passwords safely.
• Representation: An ‘s’ in the owner’s execute position: -rwsr-xr-x.
• Command: chmod u+s /path/to/executable

Set-Group-ID (SGID)

On an executable, SGID causes the process to run with the group privileges of the file’s group. When set on a directory, files created inside automatically inherit the group of the parent directory rather than the primary group of the creating user.

• Use Case: Collaborative directories where members of a group need access to newly created files.
• Representation: An ‘s’ in the group’s execute position: drwxrwsr-x.
• Command: chmod g+s /path/to/directory

The Sticky Bit

On directories, the sticky bit prevents users from deleting or renaming files unless they own the file, own the directory, or have root privileges.

• Use Case: The /tmp directory must be writable by all users (chmod 777), but users must be prevented from deleting each other’s files.
• Representation: A ‘t’ in the others’ execute position: drwxrwxrwt.
• Command: chmod +t /path/to/directory

The following command shows how to inspect these special permissions on a system:

# Example: Inspecting files with special permissions on Linux
ls -ld /usr/bin/passwd /tmp
# Output highlights SUID ('s') and the Sticky Bit ('t'):
# -rwsr-xr-x 1 root root  68208 May 21 12:00 /usr/bin/passwd
# drwxrwxrwt 9 root root 106496 May 21 12:00 /tmp

Access Control Lists (ACLs)

Standard POSIX permissions are limited to a single owner user and a single group. If a file needs to grant read access to “User A” and write access to “User B” who are not in the same group, traditional chmod cannot implement this. Access Control Lists (ACLs) resolve this by providing granular permission mapping.

Using setfacl and getfacl, administrators can assign specific permissions to arbitrary users or groups:

# Example: Explicitly grant read/write access to user alice on a config file
setfacl -m u:alice:rw /etc/application/config.yaml

# Inspect the file's extended attributes
ls -l /etc/application/config.yaml
# The '+' symbol indicates an active ACL:
# -rw-r--r--+ 1 root sysadmin 1024 May 21 12:00 /etc/application/config.yaml

# View the full ACL detail
getfacl /etc/application/config.yaml
# file: /etc/application/config.yaml
# owner: root
# group: sysadmin
user::rw-
user:alice:rw-
group::r--
mask::rw-
other::r--

Exercise: Resolving Permission Escalation Vectors

Evaluate your understanding of advanced permissions and ACL configuration in the exercises below:

# Example: Apply the Sticky Bit to the /project/shared directory
chmod +t /project/shared

# Example: Apply the Sticky Bit to the /project/shared directory
chmod  /project/shared

References & Further Reading

For additional details and specifications on advanced POSIX permissions and security attributes, consult the following sources:

• Stevens, W. R., & Rago, S. A. (2013). Advanced Programming in the UNIX Environment (3rd ed.). Addison-Wesley. (Covering Chapter 4: Files and Directories, detailing SUID, SGID, and directory sticky bits).
• Kerrisk, M. (2010). The Linux Programming Interface. No Starch Press. (Covering Chapter 15: File Attributes and Chapter 17: Access Control Lists).
• setfacl(1) Manual Page. Linux man-pages project.
• acl(5) Manual Page. Linux man-pages project.