Please enable JavaScript.

Coggle requires JavaScript to display documents.

🐧 Linux Special Permissions SUID, SGID, and Sticky Bit - Coggle Diagram

- - - - Linux controls access using:
        
        User (Owner)
        
        Group
        
        Others
      - Normal Permission Types
        
        Read (r)
        
        Permission to view data
        
        Write (w)
        
        Permission to modify data
        
        Execute (x)
        
        Permission to run file/program
      - Permission Management Commands
        
        ls -l
        
        chmod
        
        chown
        
        chgrp
  - - - Special permissions are advanced Linux permissions
        
        that modify normal user/group behavior
    - - 🔴 SUID
        
        Set User ID Permission
      - 🔵 SGID
        
        Set Group ID Permission
      - 🟢 Sticky Bit
        
        Restricted Delete Permission
- - - - SUID = Set User ID
    - - When SUID is applied to an executable file,
        
        the program runs with the permission of the file owner,
        
        not the user who executes it.
    - - User
        
        Executes Program
        
        Program runs with user's permission
    - - User
        
        Executes Program
        
        Program runs with Owner permission
    - - passwd command
      - Path:
        
        /usr/bin/passwd
      - Check:
        
        ls -l /usr/bin/passwd
      - Output:
        
        -rwsr-xr-x
      - Explanation:
        
        -
        
        Regular file
        
        rws
        
        Owner permissions
        
        r = read
        
        w = write
        
        s = SUID enabled
    - - Normal users cannot modify:
        
        /etc/shadow
      - File:
        
        /etc/shadow
      - Permission:
        
        ---------- 1 root root
      - But user can run:
        
        passwd
      - Because:
        
        passwd program temporarily gets root privilege
    - - Create file:
        
        touch test.sh
      - Make executable:
        
        chmod 755 test.sh
      - Add SUID:
        
        chmod u+s test.sh
      - Check:
        
        ls -l test.sh
      - Result:
        
        -rwsr-xr-x
    - - Normal:
        
        chmod 755 file
      - SUID:
        
        chmod 4755 file
      - Number explanation:
        
        4
        
        |
        
        SUID
        
        7
        
        |
        
        Owner permissions
        
        5
        
        |
        
        Group permissions
        
        5
        
        |
        
        Others permissions
    - - Command:
        
        chmod u-s file
      - OR
        
        chmod 0755 file
    - - Enterprise Security Audit:
        
        find / -perm -4000 2>/dev/null
    - - Dangerous SUID example:
        
        root owned SUID binary
        
        root
        
        |
        
        |
        
        SUID Program
        
        |
        
        |
        
        Normal User
      - If vulnerable:
        
        Normal user → Root access
    - - Tools:
        
        AIDE
        
        Tripwire
        
        OSSEC
        
        SIEM
- - - - SGID = Set Group ID
    - - 1️⃣ File Execution
      - 2️⃣ Directory Group Inheritance
- - - - Program executes with file owner's group privilege
    - - ls -l application
      - -rwxr-sr-x
      - s = SGID enabled
- - - - groupadd developers
    - - mkdir /shared/project
    - - chown root:developers /shared/project
    - - chmod g+s /shared/project
    - - ls -ld /shared/project
    - - drwxrwsr-x
  - - - bilal
    - - report.txt
    - - bilal bilal
  - - - /shared/project
    - - developers
    - - report.txt
    - - bilal developers
  - - - chmod 2775 directory
    - - 2
      - |
        
        SGID
      - 7
      - |
        
        Owner
      - 7
      - |
        
        Group
      - 5
      - |
        
        Others
- - - - Sticky Bit prevents users from deleting
      - files owned by other users inside a shared directory.
    - - /tmp directory
    - - ls -ld /tmp
    - - drwxrwxrwt
    - - t = Sticky Bit
- - - - /data
    - - file1
    - - delete file1
- - - - file1
    - - cannot delete file1
    - - File owner
      - Directory owner
      - Root
- - - - Sticky Bit
    - - Full permissions
- - - - SUID:
        
        4xxx
      - SGID:
        
        2xxx
      - Sticky Bit:
        
        1xxx
    - - SUID:
        
        chmod 4755 file
      - SGID:
        
        chmod 2775 directory
      - Sticky:
        
        chmod 1777 directory
      - All Together:
        
        chmod 7777 file
- - - - Commands:
        
        ls -la
        
        find / -perm -4000
        
        find / -perm -2000
        
        find / -perm -1000
    - - File Integrity Monitoring:
        
        AIDE
        
        Tripwire
        
        OSSEC
        
        Wazuh
    - - Monitor:
        
        SUID changes
        
        SGID changes
        
        Permission modification
        
        Ownership changes
        
        Unauthorized binaries
- - - - Give only required permissions
    - - Weekly/monthly permission review
    - - chmod u-s file
    - - Use:
        
        SGID + Groups
    - - Use:
        
        Sticky Bit
    - - Important paths:
        
        /usr/bin
        
        /usr/sbin
        
        /bin
        
        /etc
        
        /var/log
        
        /tmp
- - - - /project
      - Permissions:
        
        root:developers
      - SGID enabled
      - Result:
        
        All developers share files
- - - - /var/log/security
    - - soc
    - - enabled
- - - - find / -perm -4000
    - - Unknown SUID binary
- - - - /var/www/uploads
    - - enabled
- - - - A:
      - Allows program execution with file owner's privilege.
    - - A:
      - Allows group privilege inheritance.
    - - A:
      - Prevents users deleting other users' files.
    - - A:
        
        find / -perm -4000
    - - A:
        
        SGID
- - - - 👤 User Identity Change
      - File runs as Owner
    - - 👥 Group Identity Change
      - Files inherit Group
    - - 🗑 Delete Protection
      - Users protect their files