jperezduerto.info
Security in depth · Unit 22 · Lesson 6 of 44
Special bits need a purpose
Separate directory sticky-bit protection from file content permissions.
Helpful before thisLinux privilege escalation
After this lesson you can
- Explain why a sticky directory can restrict deletion without preventing file-content edits.
One idea. One situation. One reasoned decision.
How it works
Special permission bits have different jobs. Set-user-ID and set-group-ID on eligible executables can affect credentials when execution starts, subject to restrictions. Set-group-ID on a directory influences group ownership of newly created entries. The sticky bit on a directory restricts removal or renaming according to ownership; it does not make file contents read-only.
Read the supplied record
D1 is a fictional shared notes directory, owned by archive-admin. Its ordinary permissions allow Maya and Jordan to write and search the directory, and its sticky bit is set.
| Item | Supplied fact |
|---|---|
| Note owner | Maya |
| Note group | workshop |
| Note group rights | Read and write |
| Jordan | Member of workshop; owns neither note nor directory |
Assume a regular file, ordinary unprivileged processes, no extended ACLs, no additional blocking controls, and a new request. Jordan cannot remove Maya’s directory entry under the sticky rule. Jordan can edit the note’s content through the matching group-write grant. These are separate decisions, so both conclusions can be true.
If Nina’s approved requirement is “participants may read each other’s notes but edit only their own,” the directory rule alone is insufficient. Propose a reviewed adjustment to content permissions while preserving legitimate owner editing. Verify both operations separately using the stated identities.
The record does not establish what any executable’s special bits would do. Executable format, mount restrictions, and execution controls need their own evidence. Avoid describing a special bit as a universal grant of administrator access.
The key distinction: Protecting a filename's removal does not protect its contents from editing.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Under D1, which conclusion is supported about Jordan’s access to Maya’s note?
Show the answer
Correct answer: The sticky rule blocks entry removal, but the file’s group-write permission still permits content editing. Directory entry protection and file-content permissions govern different operations. Jordan meets none of the sticky-rule ownership exceptions.
Try it
- WriteFor D1, write separate decisions for removing an entry and editing its content. Name the permission responsible for each, then propose one owner-approved correction if shared content editing is unwanted.