What permissions does linux s have?

In Linux, s refers to "forced bit permissions", which is located in the third position of the user or group permission group. If the s bit is set in the user permission group, when the file is executed, the file executes the program with the file owner UID instead of the user UID; if the s bit is set in the group permission group, when the file is executed, The file is executed with the file owner GID instead of the user GID. The s permission bit is a sensitive permission bit and can easily cause system security issues.

#The operating environment of this tutorial: linux7.3 system, Dell G3 computer.

The most common file permissions in Linux systems are w, r, and x, which correspond to write, read, and execute permissions respectively. However, in addition, Linux also supports another series of permission settings, such as s permissions. , t permissions. The following introduces the specific meaning of s permissions.

s permissions

s, which means set UID or set GID. Located in the third position of the user or group permission group. If the s bit is set in the user permission group, when the file is executed, the file executes the program with the file owner UID instead of the user UID. If the s bit is set in the group permission group, when the file is executed, the file executes the program with the file owner GID instead of the user GID. The s permission bit is a sensitive permission bit and can easily cause system security issues. Please be careful when setting it up and be aware of SUID or SGID files and directories already on your system.

s permissions include two constants, S_ISUID and S_ISGID, which are called forced bit permissions;

S_ISUID can only be applied to binary executable files*;

S_ISGID can be applied to binary executable files* and directories;

*shell scripts cannot, because shell scripts are not binary files.

S_ISUID and S_ISGID are used On binary files:

• If S_ISUID is true, set the effective user ID of this process to the user ID of the owner of this file.

• If S_ISGID is true, set the effective user group ID of this process to the group ID of this file.

Since the process has a user/group ID that affects file access permissions, then Equivalent to temporarily possessing the identity of the file owner. A typical file is passwd. If a general user executes the file, during the execution process, the file can obtain root permissions, so that the user's password can be changed.

S_ISGID When used in a directory:

After the current user executes chdir to switch to the directory, the effective user group ID (effective group) of the user process will be set to the user group of the directory. If the user has w in this directory permissions, then the user group ID of the new file created by the user process is the same as the user group ID of the directory.

ls -al /usr/bin/passwd
-rwsr-xr-x 1 pythontab pythontab 32988 2018-03-16 14:25 /usr/bin/passwd

The values ​​of the two constants are:

	oct	dec
S_ISUID	4000	2048
S_ISGID	2000	1024

is the mask of the 12th and 11th bits respectively.

how to use?

We can set s permissions through character mode: chmod a s filename, or we can use absolute mode to set:

• Set suid : Set the bit before the corresponding permission bit to 4;

• Set guid: Set the bit before the corresponding permission bit to 2;

• Set both: set the bit before the corresponding permission bit to 4 2=6.

Set a file to run with the file owner UID identity:

chmod 4755 test

Set the identity of a file with the file owner's GID when running:

chmod 2755 test

Set the identity of a file with both of the above when running:

chmod 6755 test

Note: When setting the s permission, the file owner and group must first set the corresponding x permission, otherwise the s permission will not really take effect (the ch m o d command does not perform necessary integrity checks, even if the s permission is set without setting the x permission, chmod will not report an error. When we ls -l, we see rwS. The capital S indicates that the s permission is not in effect)

Summary

Executable files are equipped with this permission , you can gain privileges and arbitrarily access all system resources that the owner of the file can use. Please pay attention to files with SUID permissions. Hackers often use this permission to match the root account owner with SUID to silently open a backdoor in the system for future access.

Related recommendations: "Linux Video Tutorial"

The above is the detailed content of What permissions does linux s have?. For more information, please follow other related articles on the PHP Chinese website!