====== RH124 Advanced Permissions ======

===== NOTE =====

If you're running these commands as a non-root user, do not use the ''sudo'' command.

===== Enterable but not readable directories =====

<code>
$ chmod 0111 Poems
$ ls -ld Poems
$ ls Poems
$ cat Poems/twister
$ chmod 755 Poems
</code>

===== Strange permissions =====

It is entirely possible to set bizarre permissions on files or directories (edited for clarity):

<code>
$ ls -l letter
-[rw-][r--][r--]. 1 rpjday rpjday 1043 Nov 28  2011 letter
  (u)  (g)  (o)
$ chmod 077 letter
$ ls -l letter
-[---][rwx][rwx]. 1 rpjday rpjday 1043 Nov 28  2011 letter
$ cat letter
cat: letter: Permission denied
$ chmod 644 letter
$
</code>

===== Real vs effective ID =====

When you execute a command, it runs with your effective ID, which determines what that command is allowed to do.

First, what are your access rights to the ''cat'' command and, when you run it, what permissions does it have?

<code>
$ ls -l /usr/bin/cat
-rwxr-xr-x. 1 root root 40744 Jan 14  2026 /usr/bin/cat
$
</code>

What is it allowed to do? Let's examine the ''/etc/shadow'' file:

<code>
$ ls -l /etc/shadow
----------. 1 root root 916 Oct 23 04:09 /etc/shadow
</code>

which explains:

<code>
$ cat /etc/shadow
cat: /etc/shadow: Permission denied
$
</code>

But here's the problem: that file contains your encrypted password:

<code>
$ sudo cat /etc/shadow
... snip ...
rpjday:$y$j9T$rEkTh5W7RoZABXoeTINKHge6$XL4PTqdlSIxiP51xD24yHmlCizpYhi14Ot8UwzcQj0C::0:99999:7:::
user0:$y$j9T$jCOzJ4lgTqwN9p7mf7fxT/$iglKahqGQ4XzPlD0Z1db/s5Vg0lcH6SikSh0KXCy/FA:20743:0:99999:7:::
alex:$y$j9T$4cdGYyjkfmmy3zo6kefy91$8/t8VeZdmZwVKEtPPWg.3IKmN6i.OXJzCAUcPAmYpq4:20749:0:99999:7:::
... snip ...
</code>

which you should be allowed to change with the ''passwd'' command. So how does one get around that?
===== Setuid, Setgid and the sticky bit =====

In addition to the three levels of "rwx" bits (octal 777), there are three more permission settings **off to the left** that are not obvious:

  * setuid bit (4)
  * setgid bit (2)
  * sticky bit (1)

so a full octal representation for any file permissions would be octal 7777 (regular settings are sometimes written 0755 or 0644 or whatever).

===== The setuid bit for executable files =====

This bit means that when you run this binary executable, it will **retain** its ownership:

<code>
$ ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 91424 Feb 22  2026 /usr/bin/passwd
$
</code>

So the ''passwd'' command will effectively run with owner ''root'' and be able to edit the ''/etc/shadow'' file.

How to find all setuid programs under ''/usr/bin'':

<code>
$ find /usr/bin -perm -4000 -exec ls -l {} \;
-rwsr-xr-x. 1 root root 40600 Jan 14  2026 /usr/bin/umount
-rwsr-xr-x. 1 root root 48872 Jan 14  2026 /usr/bin/mount
-rwsr-xr-x. 1 root root 86880 Feb 22  2026 /usr/bin/chage
-rwsr-xr-x. 1 root root 73896 Feb 22  2026 /usr/bin/gpasswd
-rwsr-xr-x. 1 root root 41872 Feb 22  2026 /usr/bin/newgrp
-rwsr-xr-x. 1 root root 91424 Feb 22  2026 /usr/bin/passwd
-rws--x--x. 1 root root 24144 Jan 14  2026 /usr/bin/chsh
-rws--x--x. 1 root root 36504 Jan 14  2026 /usr/bin/chfn
-rwsr-xr-x. 1 root root 57336 Jan 14  2026 /usr/bin/su
-rwsr-xr-x. 1 root root 57528 Jan 13  2026 /usr/bin/crontab
---s--x--x. 1 root root 285424 Apr  9  2026 /usr/bin/sudo
$
</code>

How to set/unset the setuid bit on a binary executable:

<code>
$ sudo chmod u+s <files>
$ sudo chmod u-s <files>
</code>

Or if you know the **exact** final file permissions:

<code>
$ sudo chmod 4755 <files>
</code>

===== The setgid bit for executable files =====

No longer as popular but similar to above:

<code>
$ ls -l /usr/bin/write
-rwxr-sr-x. 1 root tty 24160 Jan 14  2026 /usr/bin/write
$
</code>

Find all setgid executables in ''/usr/bin'':

<code>
$ find /usr/bin -perm -2000 -exec ls -l {} \;
-rwxr-sr-x. 1 root tty 24160 Jan 14  2026 /usr/bin/write
$
</code>

How to set/unset the setgid bit:

<code>
$ sudo chmod g+s <files>
$ sudo chmod g-s <files>
</code>

If you know the exact final file permissions:

<code>
$ sudo chmod 2755 <files>
</code>

**EXERCISE**: How would you identify all executables under ''/usr/bin'' with **either** setuid or setgid bits?

===== The sticky bit (primarily for directories) =====

You can see it set for certain directories:

<code>
$ ls -ld /tmp
drwxrwxrwt. 10 root root 4096 Oct 23 04:54 /tmp
$
</code>

It means that while anyone can copy content into that directory, only that owner or root can remove it.

Find all directories with the sticky bit:

<code>
$ sudo find / -type d -perm -1000
/dev/shm
/dev/mqueue
/sys/fs/bpf
/tmp
... snip ...
$
</code>

<code>
$ ls -ld /dev/mqueue
drwxrwxrwt. 2 root root 40 Oct 23 02:00 /dev/mqueue
$
</code>

Setting/unsetting the sticky bit:

<code>
$ chmod +t <dirs>
$ chmod -t <dirs>
</code>

===== SGID bit for directories =====

This identifies directories such that, when new files or directories are created within that directory, they take on the same group affiliation of the directory itself, regardless of who does the creation.

<code>
$ find / -type d -perm -2000 2> /dev/null
</code>

How to add to a directory:

<code>
$ chmod g+s <directory name>
</code>

**NOTE**: There is no value for the SUID bit on directories.
===== Ask Google =====

Google: Does EX200 exam ask about setuid and setgid and sticky bit?

//"Yes, the Red Hat Certified System Administrator (RHCSA EX200) exam does cover special permissions, including setuid, setgid, and the sticky bit."//