Skip to main content

Chapter 5.3 - Advanced Permissions

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand special permissions (SUID, SGID, Sticky Bit)
  • Use ACL (Access Control Lists)
  • Manage permissions in an advanced way
  • Understand umask and default permissions

Special Permissions​

SUID (Set User ID)​

Behavior:

  • File executed with the owner's permissions
  • Not the user's who executes it
# Set SUID
chmod u+s file
chmod 4755 file  # 4 = SUID

# View (s instead of x)
ls -l /usr/bin/passwd
# -rwsr-xr-x 1 root root ... /usr/bin/passwd
#     ^
#     SUID

# Example: /usr/bin/passwd
# Allows users to modify /etc/shadow
# (normally accessible only to root)

Security:

  • Use with caution
  • Can be exploited if misconfigured

SGID (Set Group ID)​

Behavior:

  • File executed with the group's permissions
  • On directory: new files inherit the group
# Set SGID
chmod g+s file
chmod 2755 file  # 2 = SGID

# On directory
chmod g+s directory/
# New files created with directory's group

# View (s instead of x)
ls -ld directory/
# drwxrwsr-x ... directory/
#      ^
#      SGID

Usage:

  • Shared directories
  • Team collaboration

Sticky Bit​

Behavior:

  • On directory: prevents deletion by others
  • Only the owner can delete their files
# Set Sticky Bit
chmod +t directory/
chmod 1777 directory/  # 1 = Sticky Bit

# View (t instead of x)
ls -ld /tmp
# drwxrwxrwt ... /tmp
#          ^
#          Sticky Bit

# Example: /tmp
# Everyone can create files
# But can only delete their own files

Usage:

  • Shared directories (/tmp)
  • Prevent accidental deletion

ACL (Access Control Lists)​

Introduction​

ACL allows finer permissions than the standard system (owner/group/other).

# Install ACL tools
sudo apt install acl  # Ubuntu/Debian
sudo yum install acl  # Red Hat/CentOS

View ACL​

# View file ACL
getfacl file.txt

# View directory ACL
getfacl directory/

# Example output:
# # file: file.txt
# # owner: user1
# # group: users
# user::rw-
# group::r--
# other::r--

Set ACL​

# Allow user2 to read/write
setfacl -m u:user2:rw file.txt

# Allow a group
setfacl -m g:developers:rwx directory/

# Allow others
setfacl -m o::r file.txt

# Default ACL (inherited)
setfacl -d -m u:user2:rw directory/
# New files will inherit this ACL

Remove ACL​

# Remove user ACL
setfacl -x u:user2 file.txt

# Remove all ACLs
setfacl -b file.txt

ACL Mask​

The mask limits effective permissions:

# Set mask
setfacl -m m::r file.txt
# Even if ACL gives rwx, mask limits to r

umask - Default Permissions​

What is umask?​

The umask determines the default permissions for new files and directories.

# View current umask
umask

# Octal format (often 0022 or 0002)

Calculating Permissions​

Files:

  • Base permissions: 666 (rw-rw-rw-)
  • Final permissions: 666 - umask

Directories:

  • Base permissions: 777 (rwxrwxrwx)
  • Final permissions: 777 - umask

Examples​

# umask 022
# Files: 666 - 022 = 644 (rw-r--r--)
# Directories: 777 - 022 = 755 (rwxr-xr-x)

# umask 002
# Files: 666 - 002 = 664 (rw-rw-r--)
# Directories: 777 - 002 = 775 (rwxrwxr-x)

# umask 077
# Files: 666 - 077 = 600 (rw-------)
# Directories: 777 - 077 = 700 (rwx------)

Set umask​

# Temporary (session)
umask 002

# Permanent (in ~/.bashrc or /etc/profile)
umask 002

Practical Examples​

Scenario 1: Shared Directory​

# Create shared directory
sudo mkdir /srv/shared
sudo chgrp developers /srv/shared
sudo chmod 2775 /srv/shared  # SGID

# New files will inherit the group

Scenario 2: Fine Permissions​

# File with specific permissions
setfacl -m u:user1:rw file.txt
setfacl -m u:user2:r file.txt
setfacl -m g:developers:rwx file.txt

Scenario 3: Collaborative Directory​

# Directory where everyone can create but not delete
sudo mkdir /srv/collab
sudo chmod 1777 /srv/collab  # Sticky Bit + all rights

Summary​

In this chapter, you learned:

SUID: Execution with owner's permissions
SGID: Execution with group's permissions, group inheritance
Sticky Bit: Prevents deletion by others
ACL: Fine permissions, more flexible than standard
umask: Default permissions for new files
Practice: Combine for specific needs

Next Steps​

Chapter 5.4: Best Practices
Module 6: Shell Scripting

Chapter created on: December 2024