Linux compulsory bit and adventure position tips introduction

The linuxext3 file system supports special permissions for the mandatory bits (setuid and setgid) and the risky (sticky). For u, g, o, there are set uid, set gid, and sticky.

The force and risk bits are added at the execution permission: if there is already an execution permission at that location, the force and risk bits are represented in lowercase letters; otherwise, they are in uppercase letters. Set uid and set gid use one s for each of the x positions of u and g, and sticky uses a t.

When a file has setuid, and the other groups have executable permissions, then when the other group executes the program, others will have the owner permission for the file.

By default, the file created by the user belongs to the group the user is currently in. Setgid is set on the directory, indicating that files created by anyone in this directory will belong to the group to which the directory belongs.

By default, if you have w and x permissions on a directory, anyone can create and delete files in this directory. Once the adventure bit is set on the directory, it means that only the owner of the file, and root, can delete the file in this directory.

On the executable, the user can add set uid and set gid. By default, the user executes an executable that will run the process as the user. After the force bit is added to the executable file, the user can execute the instruction to run the process as the owner of the instruction file or the group to which it belongs.

Users can use the chmod command to set the force and risk bits for the file.

set uid:chmod u+s filename

set gid:chmod g+s filename

sticky:chmod o+t filename

The forced and risk bits can also be specified by a three-digit sum of the number of digits read and written.

4(set uid)

2(set gid)

1(sticky)

Forcing bits to file

On the executable, the user can add set uid and set gid. By default, the user executes an instruction that runs the process as the user. A force bit on the instruction file that allows the user to execute an instruction that runs the process as the owner of the instruction file or the group to which it belongs. Here is a good example. You manage several large database systems, and backing them up requires system administration privileges. You wrote a few scripts and set their setuid so that some of the users you specify can do the job by executing these scripts without having to log in as a database administrator to avoid accidentally destroying the database server. By executing these scripts, they can complete database backups and other administrative tasks, and after the scripts finish running, they will revert to their privileges as regular users. Another example is /bin /passwd. To read and write the /etc/passwd file requires superuser privileges, but the average user also needs to be able to change their own password at any time, so /bin/passwd sets the setuid, when the user changes their password. When you have superuser privileges.

Forcing bits to the directory

By default, the files created by the user belong to the group the user is currently in. Setgid is set on the directory, indicating that files created by anyone in this directory will belong to the group to which the directory belongs.