Directory permissions and special bits

Directories are lists of names

A directory is a file whose contents are pairs of *name → inode number*. Once you hold that picture, its permission bits stop being mysterious. r lets you read the list, so ls works. x lets you *use* an entry: pass through the directory to reach something inside by name, cd into it, open dir/file. w lets you change the list: create, delete and rename entries, and it only counts together with x, because you must reach the entry to modify it.

The last row is the one that bites: with w on a directory you can delete *anyone's* file in it, because deletion is a change to the list, not to the file. That is what the sticky bit fixes.

The three special bits

~% ls -ld /tmp /bin/busybox
-rwsr-xr-x    1 root     root        592196 Jul 21  2018 /bin/busybox
drwxrwxrwt    2 root     root            60 Oct  4 18:51 /tmp
~% cd /root/lab/l50
l50% chmod +t dropbox; chmod g+s team
l50% ls -ld dropbox team
drwxrwxrwt    2 root     root             0 Oct  4 19:30 dropbox
drwxrwsr-x    2 root     root             0 Oct  4 19:30 team
l50% chmod 1777 dropbox; chmod 2775 team   # the same, in octal

/tmp is the textbook sticky directory: drwxrwxrwt, everyone may create files, nobody may remove anyone else's. /bin/busybox is setuid root in this image so that applets like passwd and su, which need to edit /etc/shadow or change identity, work for ordinary users; when alice runs passwd the process briefly has UID 0. That is powerful and dangerous, which is why chown strips these bits and why find / -perm -4000 is a standard security audit (lesson 36).

A setgid directory is the practical one for teams: make team belong to group devs, set g+s, and every file anyone creates inside gets group devs automatically instead of the creator's private group, so the 664/775 modes from the umask lesson actually let colleagues edit each other's work. Symbolically the bits are s (for u or g) and t; in octal they are the fourth, leading digit: chmod 1777, chmod 2775, chmod 4755.