Special Permissions: SUID, SGID and the Sticky Bit

SUID: run as the owner

Your password is stored in /etc/shadow, which only root can change. So how can passwd change your password? Look at it:

ls -l /usr/bin/passwd /etc/shadow

In the terminal

student@vulntech:~$ ls -l /usr/bin/passwd /etc/shadow
-rw-r----- 1 root shadow   422 Oct 17 05:31 /etc/shadow
-rwsr-xr-x 1 root root   91312 Oct  3  2024 /usr/bin/passwd

The s in place of the owner's x is the SUID bit (set user ID). A SUID program runs with the permissions of its owner, here root, whoever starts it. sudo and su work the same way.

SGID on a directory: a shared group

On a directory, the SGID bit (set group ID) makes every new file inside belong to the directory's group, instead of the creator's own group. Perfect for team folders:

sudo mkdir /srv/team
sudo chgrp crew /srv/team
sudo chmod g+ws /srv/team
ls -ld /srv/team
sudo touch /srv/team/plan.txt
ls -l /srv/team

In the terminal

student@vulntech:~$ sudo mkdir /srv/team
[sudo] password for student:
student@vulntech:~$ sudo chgrp crew /srv/team
student@vulntech:~$ sudo chmod g+ws /srv/team
student@vulntech:~$ ls -ld /srv/team
drwxrwsr-x 2 root crew 0 Oct 17 06:31 /srv/team
student@vulntech:~$ sudo touch /srv/team/plan.txt
student@vulntech:~$ ls -l /srv/team
total 1
-rw-r--r-- 1 root crew 0 Oct 17 06:31 plan.txt

The sticky bit: only delete your own files

/tmp is open to everyone: rwxrwxrwt. Normally w on a directory lets you delete any file in it. The t, the sticky bit, changes that: you may only delete your own files. Here Alice left a file in /tmp:

ls -ld /tmp
ls -l /tmp/alice.txt
rm -f /tmp/alice.txt

In the terminal

student@vulntech:~$ ls -ld /tmp
drwxrwxrwt 4 root root 0 Oct 17 05:31 /tmp
student@vulntech:~$ ls -l /tmp/alice.txt
-rw-r--r-- 1 alice alice 15 Oct 17 06:32 /tmp/alice.txt
student@vulntech:~$ rm -f /tmp/alice.txt
rm: cannot remove '/tmp/alice.txt': Operation not permitted

Setting the special bits

Why attackers love SUID

A SUID root program that can be tricked into running other commands hands out root to anyone. That's why one of the first things a penetration tester does on a new machine is list all SUID programs, and why admins keep the list short:

find / -xdev -perm -4000 -type f 2>/dev/null

In the terminal

student@vulntech:~$ find / -xdev -perm -4000 -type f 2>/dev/null
/bin/bbsuid
/bin/su
/usr/bin/chage
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/expiry
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/sudo

Tip: -perm -4000 means has at least the SUID bit, and -xdev stays on this disk. Anything unusual in this list deserves a close look.

Remember: SUID (4, u+s) runs as the owner. SGID (2, g+s) on a folder shares its group. Sticky (1, +t) lets only owners delete. Audit SUID files with find / -perm -4000.