Let's dive deeper into Linux file permissions. Besides read, write and execute for the owner, the group 1
and the others, that there are three extra special permissions for each file or directory. 2
These are suid or set user id, sgid or set group id and sticky bit 3
These special modes are for a file or a directory overall, not just for a user category. 4
Let's see what they mean 5
and start with the first one, which is SUID. 6
By default Linux commands and programs run with the same exact permissions of the user who 7
executes them. 8
Let’s take a common Linux command such as cat. The cat command runs with the permissions of the user 9
who executes it. If the user has the rights to have your file, which means the read permission, then 10
the cat command will also have that right and will display the file’s contents. 11
It doesn't matter that the owner of the cat executable binary is root. 12
The owner of the executable is root, but the program will run with the privileges of the user 13
who executed. 14
This is how Linux works, and this is really important in regards to the whole system security since 15
each user has very limited access and all the commands run by a user will have the same access in 16
the system. Sometimes it's required to temporarily treat users as root or as another user 17
and this is where the suid or set user id bit comes into play. 18
When an executable file with your SUID is executed, the resulting process will have the permissions 19
of the owner of the command, not the permission of the user who executes the command. 20
This is very important! 21
Keep this in mind! 22
Let's return to the cat command. 23
If the cat binary has the SUID bit set, then the cat command will run only with root privileges, 24
no matter who runs it. 25
That's because root is the owner of the executable file. 26
Let me demonstrate this with an example! 27
As a non-privileged user 28
I’ll try to display the contents of the shadow file using cat: cat /etc/shadow 29
And of course I've got permission denied because the cat command ran with the permission of the user 30
who executed it and that was a privileged user. 31
If we displayed the file’s permissions, 32
we’ll see that the user called student, the current user, 33
belongs to the others class and has no permissions at all, 34
hence cat has no permissions at all on that file. 35
But If I set SUID on the cat binary, the command will have the permissions of its owner, 36
which is root, no matter who runs it. Let’s set suid on the cat executable file. 37
There are two ways to do that; if you want to use the numerical mode, then simply prepend for to the 38
existing permissions. 39
Let's see the existing permissions of cat. 40
Now, the existing permissions in numerical mode are 0755 or simply said 755 41
and the new permissions will be 4755. 42
By the way, if you run the stat command on a file, you'll see a zero before the three digits 43
that represents the permissions. 44
That means that the file has no special permissions like suid, sgid or sticky bit. 45
I'm setting the SUID bit on the file. 46
Of course as root. 47
You can verify if SUID bit is applied or not on a file by using the ls -l command: 48
The file is displayed in another color. 49
Simply look at the position of the execution, permission for the owner, the letter s at that position 50
means SUID bit. 51
In some cases, you will see a capital S instead of a small s. Capital S indicates that there 52
is no executable permission applied to that file. 53
I'm removing the execution permission. 54
You'll see a capital S on that position. 55
I'm putting back the execution permission for the owner. 56
You can also check the SUID bit by running the stat command. 57
You see a 4 on the first position and s on the execute position of the owner. 58
The second way to set SUID bit on a file is to use the symbolic mode. 59
sudo chmod u+s and the path to the final. 60
Now the cat command has the SUID bit set and that means that it will have the permissions of its owner 61
which is root, no matter who will execute it. 62
As a non privileged user 63
I'll try to see the contents of the shadow file again. 64
And this time the file contents were displayed because the command ran with root privileges, even 65
though a non privileged user had executed it. 66
In fact, at this moment, any non privileged user can see any file of the system. 67
Now, if you've followed this example, it's important to remove the SUID bit because otherwise bad things 68
could happen in the future. 69
And I'm checking the permissions. 70
Oh, sorry, I have removed the execution permission instead of SUID. 71
No problem, I'll put it back. 72
So -s to remove SUID. 73
So these are the correct permissions. 74
755 75
And cat /etc/shadow 76
And as expected I've got the permission denied error. 77
Now that you know what suid means, how to set and display it maybe you wonder why is that necessary? 78
At first sight, it seems a security risk. Let's think about the passwords. On Linux, stored passwords 79
are saved in a file, and only someone with root privileges can access the file that contains the passwords. 80
This is the file that contains the passwords. 81
That might sound fine, but if only root can access stored passwords, how do non privileged users have 82
access to change their own passwords? 83
And the answer is 84
SUID 85
The comment, which in this case is pay the police W.T.. 86
This command, has the suid bit set and that means that when someone runs the command, this command 87
is run with root privileges and not with the limited privileges of the one that executes it, because 88
root is the owner. 89
Let's check if that's true! 90
Root is the owner and the program has the SUID bit set. 91
There are lots of Linux commands that use the SUID bit to give the command elevated privileges when run 92
by a regular user. 93
To find all commands that have the SUID bit set run the find command with -perm option 94
like this: find the path /usr/bin/ for example -perm -4000 95
This means find all files that have at least these permissions. 96
I need to put a minus sign before the permissions because I'm searching for all files that have at least 97
these permissions. 98
All these executable files have the SUID bit set. 99
Also note that programs that run with elevated privileges or have the SUID bit set can pose security 100
risks if they are not created with a security by design mindset. 101
The problem is that if intruders find an executable file that belongs to the root user and has the SUID 102
bit set that they can use that to exploit the system; it's necessary to ensure that insecure programs 103
with the SUID bit set that are not installed on the system.