Linux Permissions
Linux Permissions
Linux Special Permissions: setuid
NB: This tutorial has worked on Centos 6,7,8 and 9
The SetUID (Set User ID) permission in Linux is a special permission that can be assigned to executable files. When an executable file has the SetUID bit set, it allows the program to run with the privileges of the file owner, rather than the user who is executing the program. This can be particularly useful when a program needs elevated privileges for certain operations.
- Password Changing Program:: One common example of SetUID is in the password-changing program (/usr/bin/passwd). The passwd command needs to modify the /etc/shadow file, which is usually only writable by the root user. However, regular users need to be able to change their passwords without giving them full root access. Therefore, the passwd executable has the SetUID bit set.
ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 54256 Jan 1 2022 /usr/bin/passwd
| Special Permission | Letter Representation | Numerical (Octal) Representation | Types of files it works on |
|---|---|---|---|
| setuid | s | 4 | executable files |
Remember that the octal representation combines the read (4), write (2), and execute (1) permissions, and you add these values to create the three-digit octal number for each category of users. Adding 4 for SetUID only affects the owner's digit. Always be careful when using chmod and modifying permissions, as incorrect settings can lead to security vulnerabilities.
Examples of setuid using letter representation
The setuid bit is enabled by running the command “chmod u+s example.txt”. This enables it on the example.txt file. Notice that when do a long listing with “ls -l” that a letter “S” shows up on the user section of the permissions. See the arrow in the figure.
To remove the setuid, we simply run the command “chmod u-s example.txt” and when we list the contents using “ls -l” we see that the letter “s” is now removed.
Examples of setuid using numbers (octal) representation
In octal form, we can use the number “4” in front of the permissions for the user,group and others as seen in the figure. “4644” in this case. The leftmost “4” is for the sticky bit, the remaining three numbers are for the standard permisions.
To remove the setuid in octal form, we place a zero “0” in front of the standard permissions as seen in the figure with the red arrow pointing at the zero. When we list using “ls -l” , we see that the letter “s” is not part of the user section of the example.txt file.