Recovered from the older tannerjc.net wiki snapshot dated January 23, 2016.

Sticky Bit vs set UID and set GID

I have always been confused by the sticky bit and set uid and set gid.

From reading the below information I think it’s basically this:

sticky bit keeps non owners from deleting a file (like /tmp has)

setuid and setgid set the effective user id and effective group id when a file is executed.

  • however** if setuid and setgid are enabled on a directory this is where it will force any subsequent files/directories to be created with the same uid or gid.

That was the big difference I was missing.

$ info permissions

hit enter on

  • File permissions: (coreutils)File permissions.

Structure of File Mode Bits

27.1 Structure of File Mode Bits
================================
snip
 In addition to the three sets of three permissions listed above, the
file mode bits have three special components, which affect only
executable files (programs) and, on most systems, directories:

  1. Set the process's effective user ID to that of the file upon
     execution (called the set-user-ID bit, or sometimes the setuid
     bit).  For directories on a few systems, give files created in
     the directory the same owner as the directory, no matter who
     creates them, and set the set-user-ID bit of newly-created
     subdirectories.

  2. Set the process's effective group ID to that of the file upon
     execution (called the set-group-ID bit, or sometimes the setgid
     bit).  For directories on most systems, give files created in the
     directory the same group as the directory, no matter what group
     the user who creates them is in, and set the set-group-ID bit of
     newly-created subdirectories.

  3. Prevent unprivileged users from removing or renaming a file in a
     directory unless they own the file or the directory; this is
     called the restricted deletion flag for the directory, and is
     commonly found on world-writable directories like `/tmp'.

     For regular files on some older systems, save the program's text
     image on the swap device so it will load more quickly when run;
     this is called the sticky bit.

Numeric Modes:: File mode bits as octal numbers.

hit enter on

  • Numeric Modes:: File mode bits as octal numbers.
27.3 Numeric Modes
==================
snip
     Value in  Corresponding
     Mode      Mode Bit

               Other users not in the file's group:
        1      Execute/search
        2      Write
        4      Read

               Other users in the file's group:
       10      Execute/search
       20      Write
       40      Read

               The file's owner:
      100      Execute/search
      200      Write
      400      Read

               Special mode bits:
     1000      Restricted deletion flag or sticky bit
     2000      Set group ID on execution
     4000      Set user ID on execution

Directory Setuid and Setgid:: Set-user-ID and set-group-ID on directories

hit enter on

* Directory Setuid and Setgid:: Set-user-ID and set-group-ID on directories.
File: coreutils.info,  Node: Directory Setuid and Setgid,  Prev: Numeric Modes,  Up: File permissions

27.4 Directories and the Set-User-ID and Set-Group-ID Bits
==========================================================

On most systems, if a directory's set-group-ID bit is set, newly
created subfiles inherit the same group as the directory, and newly
created subdirectories inherit the set-group-ID bit of the parent
directory.  On a few systems, a directory's set-user-ID bit has a
similar effect on the ownership of new subfiles and the set-user-ID
bits of new subdirectories.  These mechanisms let users share files
more easily, by lessening the need to use `chmod' or `chown' to share
new files.

   These convenience mechanisms rely on the set-user-ID and set-group-ID
bits of directories.  If commands like `chmod' and `mkdir' routinely
cleared these bits on directories, the mechanisms would be less
convenient and it would be harder to share files.  Therefore, a command
like `chmod' does not affect the set-user-ID or set-group-ID bits of a
directory unless the user specifically mentions them in a symbolic
mode, or sets them in a numeric mode.  For example, on systems that
support set-group-ID inheritance:

     # These commands leave the set-user-ID and
     # set-group-ID bits of the subdirectories alone,
     # so that they retain their default values.
     mkdir A B C
     chmod 755 A
     chmod 0755 B
     chmod u=rwx,go=rx C
     mkdir -m 755 D
     mkdir -m 0755 E
     mkdir -m u=rwx,go=rx F

   If you want to try to set these bits, you must mention them
explicitly in the symbolic or numeric modes, e.g.:

     # These commands try to set the set-user-ID
     # and set-group-ID bits of the subdirectories.
     mkdir G H
     chmod 6755 G
     chmod u=rwx,go=rx,a+s H
     mkdir -m 6755 I
     mkdir -m u=rwx,go=rx,a+s J

   If you want to try to clear these bits, you must mention them
explicitly in a symbolic mode, e.g.:

     # This command tries to clear the set-user-ID
     # and set-group-ID bits of the directory D.
     chmod a-s D

   This behavior is a GNU extension.  Portable scripts should not rely
on requests to set or clear these bits on directories, as POSIX allows
implementations to ignore these requests.

ACLs

Issue

  • application/service has special user/group set on files it creates
  • have a need to let other users not related to this application/service manage the same files

Resolution

  • Use file Access Control Lists to allow read/write/execute permissions to other users

Diagnostic Steps

  • set default mount options to use ACLs for file system
  • enable ACLs on file system by remounting
  • use setfacl to change default ACLs recursively on affected directories
  • use setfacl to change current ACLs recursively on affected directories
1013  tune2fs -o acl /dev/mapper/efserv
 1014  tune2fs -l /dev/mapper/efserv | grep -i options
 1015  mount -o remount,acl /efserv
 1016  mount | grep efserv
 1017  setfacl -R -m d:u:john:rwx Torrents
 1018  getfacl Torrents
 1019* setfacl -R -m d:u:jtanner:rwx Torrents
 1020  getfacl Torrents
 1021  getfacl Torrents-transmission/
 1022  mkdir /efserv/Torrents/test
 1023  getfacl /efserv/Torrents/test/
 1024  ls -l
 1025  setfacl -R -m d:u:john:rwx Torrents-tfb4rt/
 1026  setfacl -R -m d:u:jtanner:rwx Torrents-tfb4rt/
 1027  setfacl -R -m d:u:jtanner:rwx Torrents-transmission/
 1028  setfacl -R -m d:u:john:rwx Torrents-transmission/
 1029  setfacl -R -m :u:john:rwx Torrents-transmission/
 1030  setfacl -R -m u:john:rwx Torrents-transmission/
 1031* setfacl -R -m u:jtanner:rwx Torrents
 1032  setfacl -R -m u:john:rwx Torrents
 1033  setfacl -R -m u:jtanner:rwx Torrents
 1034  setfacl -R -m u:jtanner:rwx Torrents-tfb4rt/
 1035  setfacl -R -m u:john:rwx Torrents-tfb4rt/

References

getfacl(1)