RH124 Advanced Permissions

It is entirely possible to set bizarre permissions on files or directories (edited for clarity):

$ ls -l letter
-[rw-][r--][r--]. 1 rpjday rpjday 1043 Nov 28  2011 letter
  (u)  (g)  (o)
$ chmod 077 letter
$ ls -l letter
-[---][rwx][rwx]. 1 rpjday rpjday 1043 Nov 28  2011 letter
$ cat letter
cat: letter: Permission denied
$ chmod 644 letter
$

When you execute a command, it runs with your effective ID, which determines what that command is allowed to do.

First, what are your access rights to the cat command and, when you run it, what permissions does it have?

$ ls -l /usr/bin/cat
-rwxr-xr-x. 1 root root 40744 Jan 14  2026 /usr/bin/cat
$

What is it allowed to do? Let's examine the /etc/shadow file:

$ ls -l /etc/shadow
----------. 1 root root 916 Oct 23 04:09 /etc/shadow

which explains:

$ cat /etc/shadow
cat: /etc/shadow: Permission denied
$

But here's the problem: that file contains your encrypted password:

$ sudo cat /etc/shadow
... snip ...
rpjday:$y$j9T$rEkTh5W7RoZABXoeTINKHge6$XL4PTqdlSIxiP51xD24yHmlCizpYhi14Ot8UwzcQj0C::0:99999:7:::
user0:$y$j9T$jCOzJ4lgTqwN9p7mf7fxT/$iglKahqGQ4XzPlD0Z1db/s5Vg0lcH6SikSh0KXCy/FA:20743:0:99999:7:::
alex:$y$j9T$4cdGYyjkfmmy3zo6kefy91$8/t8VeZdmZwVKEtPPWg.3IKmN6i.OXJzCAUcPAmYpq4:20749:0:99999:7:::
... snip ...

which you should be allowed to change with the passwd command. So how does one get around that?

In addition to the three levels of “rwx” bits (octal 777), there are three more permission settings off to the left that are not obvious:

• setuid bit (4)
• setgid bit (2)
• sticky bit (1)

so a full octal representation for any file permissions would be octal 7777 (regular settings are sometimes written 0755 or 0644 or whatever).

This bit means that when you run this binary executable, it will retain its ownership:

$ ls -l /usr/bin/passwd
-rwsr-xr-x. 1 root root 91424 Feb 22  2026 /usr/bin/passwd
$

So the passwd command will effectively run with owner root and be able to edit the /etc/shadow file.

How to find all setuid programs under /usr/bin:

$ find /usr/bin -perm -4000 -exec ls -l {} \;
-rwsr-xr-x. 1 root root 40600 Jan 14  2026 /usr/bin/umount
-rwsr-xr-x. 1 root root 48872 Jan 14  2026 /usr/bin/mount
-rwsr-xr-x. 1 root root 86880 Feb 22  2026 /usr/bin/chage
-rwsr-xr-x. 1 root root 73896 Feb 22  2026 /usr/bin/gpasswd
-rwsr-xr-x. 1 root root 41872 Feb 22  2026 /usr/bin/newgrp
-rwsr-xr-x. 1 root root 91424 Feb 22  2026 /usr/bin/passwd
-rws--x--x. 1 root root 24144 Jan 14  2026 /usr/bin/chsh
-rws--x--x. 1 root root 36504 Jan 14  2026 /usr/bin/chfn
-rwsr-xr-x. 1 root root 57336 Jan 14  2026 /usr/bin/su
-rwsr-xr-x. 1 root root 57528 Jan 13  2026 /usr/bin/crontab
---s--x--x. 1 root root 285424 Apr  9  2026 /usr/bin/sudo
$

How to set/unset the setuid bit on a binary executable:

$ sudo chmod u+s <files>
$ sudo chmod u-s <files>

Or if you know the exact final file permissions:

$ sudo chmod 4755 <files>

No longer as popular but similar to above:

$ ls -l /usr/bin/write
-rwxr-sr-x. 1 root tty 24160 Jan 14  2026 /usr/bin/write
$

Find all setgid executables in /usr/bin:

$ find /usr/bin -perm -2000 -exec ls -l {} \;
-rwxr-sr-x. 1 root tty 24160 Jan 14  2026 /usr/bin/write
$

How to set/unset the setgid bit:

$ sudo chmod g+s <files>
$ sudo chmod g-s <files>

If you know the exact final file permissions:

$ sudo chmod 2755 <files>

EXERCISE: How would you identify all executables under /usr/bin with either setuid or setgid bits?

You can see it set for certain directories:

$ ls -ld /tmp
drwxrwxrwt. 10 root root 4096 Oct 23 04:54 /tmp
$

It means that while anyone can copy content into that directory, only that owner or root can remove it.

Find all directories with the sticky bit:

$ sudo find / -type d -perm -1000
/dev/shm
/dev/mqueue
/sys/fs/bpf
/tmp
/tmp/.X11-unix
/tmp/.ICE-unix
/tmp/.XIM-unix
/tmp/.font-unix
/tmp/systemd-private-f5f7d1e9279c4beebbdb24085e4c3d82-dbus-broker.service-rm2smd/tmp
/tmp/systemd-private-f5f7d1e9279c4beebbdb24085e4c3d82-chronyd.service-KYCF1b/tmp
/tmp/systemd-private-f5f7d1e9279c4beebbdb24085e4c3d82-irqbalance.service-Xglrdp/tmp
/tmp/systemd-private-f5f7d1e9279c4beebbdb24085e4c3d82-systemd-logind.service-dLohsJ/tmp
/var/tmp
/var/tmp/systemd-private-f5f7d1e9279c4beebbdb24085e4c3d82-dbus-broker.service-lkWgGX/tmp
/var/tmp/systemd-private-f5f7d1e9279c4beebbdb24085e4c3d82-chronyd.service-n9CB6t/tmp
/var/tmp/systemd-private-f5f7d1e9279c4beebbdb24085e4c3d82-irqbalance.service-WjxydR/tmp
/var/tmp/systemd-private-f5f7d1e9279c4beebbdb24085e4c3d82-systemd-logind.service-LeW18R/tmp
$

$ ls -ld /dev/mqueue
drwxrwxrwt. 2 root root 40 Oct 23 02:00 /dev/mqueue
$

Setting/unsetting the sticky bit:

<code>
$ chmod +t <dirs>
$ chmod -t <dirs>