Unit 5: Permissions · Lesson 4 of 6 · 18 min
SUID, SGID and the sticky bit
The three extra bits that change who a program runs as and who can delete what.
mission
- You are
- You are auditing privileged programs on web01.
- Situation
- A few programs must run with more power than the person who starts them. Each one is a door to root if it is the wrong program.
- Goal
- List every SUID program and explain each special bit you meet.
- Hand in
- The count of SUID files and the one that does not belong.
Meet the three bits
stat -c '%a %A %U %G %n' /usr/bin/passwd /usr/bin/crontab /tmp
4755 -rwsr-xr-x root root /usr/bin/passwd
2755 -rwxr-sr-x root crontab /usr/bin/crontab
1777 drwxrwxrwt root root /tmp
you should see s in the owner slot is SUID (4), s in the group slot is SGID (2), t at the end is the sticky bit (1).
What each bit does
| Command | What it does |
|---|---|
4 SUID | The program runs as its owner. passwd needs it to write /etc/shadow |
2 SGID | The program runs with its group. crontab uses it to reach the cron spool |
1 sticky | In a shared folder, you can only delete your own files. /tmp uses it |
List every SUID file
find / -xdev -perm -4000 -type f 2>/dev/null | sort /usr/bin/chfn /usr/bin/chsh /usr/bin/gpasswd /usr/bin/mount /usr/bin/newgrp /usr/bin/passwd /usr/bin/su /usr/bin/sudo /usr/bin/umount /usr/lib/openssh/ssh-keysign /usr/local/bin/backup-helper dpkg -S /usr/bin/passwd passwd: /usr/bin/passwd dpkg -S /usr/local/bin/backup-helper dpkg-query: no path found matching pattern /usr/local/bin/backup-helper
you should see Ten come from packages. The one in /usr/local was added by hand and runs as root for anyone.
defender tip Keep a saved SUID list per server and diff it in your audit. New entries are always worth a question.
List every SGID program
find / -xdev -perm -2000 -type f 2>/dev/null | sort
/usr/bin/chage
/usr/bin/crontab
/usr/bin/expiry
/usr/bin/ssh-agent
/usr/sbin/pam_extrausers_chkpwd
/usr/sbin/unix_chkpwd
you should see Six programs, all from packages. Each runs with an extra group.
What a defender takes away
- 1SUID runs as the owner, SGID as the group.
- 2The sticky bit protects shared folders like /tmp.
- 3Every SUID file must come from a package or have a written reason.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.