--- title: "Special Permissions in Linux: SUID, SGID, & Sticky Bit" description: "Learn the ins-and-outs of special permissions in Linux through the use of SUID, SGID, and the Sticky Bit in this ATA Learning tutorial!" canonical: "https://adamtheautomator.com/special-permissions-in-linux/" --- # Special Permissions in Linux: SUID, SGID, & Sticky Bit > Learn the ins-and-outs of special permissions in Linux through the use of SUID, SGID, and the Sticky Bit in this ATA Learning tutorial! Source: https://adamtheautomator.com/special-permissions-in-linux/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Special Permissions in Linux: SUID, SGID, & Sticky Bit](https://adamtheautomator.com/wp-content/uploads/2023/11/special-permissions-in-linux.jpg) # Special Permissions in Linux: SUID, SGID, & Sticky Bit [![](https://secure.gravatar.com/avatar/b1faae2f957a0d43de36dfd25e8c08537718fb87c49cfd0a15b0e860a7f7b9a0?s=192&d=mm&r=g)Mercy Bassey](https://adamtheautomator.com/author/mercy-bassey/)8 November 20239 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Linux](/tag/linux/) Table of Contents * [Prerequisites](#prerequisites) * [Executing Files with Special Permissions in Linux (SUID)](#executing-files-with-special-permissions-in-linux-suid) * [Enabling Collaborative Workflows in Linux Directories (SGID)](#enabling-collaborative-workflows-in-linux-directories-sgid) * [Protecting Files Within Directories (Sticky Bit)](#protecting-files-within-directories-sticky-bit) * [Conclusion](#conclusion) Have you ever found yourself in a situation where you needed to perform a task on a Linux system, only to be met with a frustrating access denial? Well, say goodbye to those woes and welcome the world of special permissions in Linux! This tutorial is your ticket to mastering the finer points of special permissions in Linux — Sticky Bit, Set User ID (SUID), and Set Group ID (SGID). These special permissions offer a higher level of security control. Read on and securely manage your files with precision and confidence! ## Prerequisites Before you jump into the details of special permissions in Linux, ensure you have a Linux machine. This tutorial uses Ubuntu 22.04 LTS (Jammy Jellyfish) for hands-on demonstrations. Related: [Install Ubuntu Server 20.04: A Step-by-Step Walkthrough](https://adamtheautomator.com/install-ubuntu/) ## Executing Files with Special Permissions in Linux (SUID) [Linux file permissions](https://adamtheautomator.com/chmod-and-chown/) typically determine a user’s ability to read, write, or execute a file based on their permissions and those of their group. Yet, there are situations where a user must execute a file with the permissions of the file’s owner rather than their own. Related:[Master Linux Permissions: A Deep Dive into Chmod and Chown](https://adamtheautomator.com/chmod-and-chown/) For instance, consider a program that only root users can run, but there’s a need for a regular user to execute it for a specific task. In such cases, SUID becomes invaluable. To see how to set SUID permissions, follow these steps: 1\. Open the terminal and execute the following commands to create a user (`useradd`) called `A-user` (arbitrary) and give it a password (`passwd`). ```bash sudo useradd A-user sudo passwd A-user ``` ![special permissions in linux - Creating a new user ](https://adamtheautomator.com/wp-content/uploads/2023/11/image-44.png) Creating a new user Related:[How to Create Users on Ubuntu Linux in Multiple Ways](https://adamtheautomator.com/create-user-on-ubuntu/) 2\. Next, run the `stat` command below to view the existing permissions of the `cat` command. ```bash stat /usr/bin/cat ``` Take note of the access permissions below, as you’ll be needing it for comparisons later: * **0755** – Allows the file to be executed with the permissions of its owner, providing elevated privileges to non-privileged users when running the file. * **\-rwxr-xr-x** – Sets permission to the owner to read, write, and execute the file (**rwx**), while group members and other users can read and execute the file (**r-x** and **r-x**). ![Viewing access permissions of the cat command](https://adamtheautomator.com/wp-content/uploads/2023/11/image-43.png) Viewing access permissions of the `cat` command 3\. Now, run the below `chmod` command, which does not provide output but sets the SUID bit on the `cat` command. This command allows the `cat` command to run with the file owner’s permissions rather than the permissions of the user running the command. > 💡 _Note that using SUID should be done with caution, as it can potentially introduce security risks if not implemented properly. Ensure you only apply SUID to trusted commands and files._ ```bash sudo chmod u+s /usr/bin/cat ``` Related:[Manage Directory and File Permissions with chmod Recursive](https://adamtheautomator.com/chmod-recursive/) 4\. Once you’ve set the SUID bit, run the following `stat` command to verify the SUID bit by rechecking the permissions of the `cat` command. ```bash stat /usr/bin/cat ``` If successful, you’ll see the following, where you’ll make a comparison with the information you noted in step two: * **0755** changed to **4755**, where the number **4** represents the SUID bit. * **\-rwxr-xr-x** changed to **\-rwsr-xr-x**, where **s** represents the user’s execute (**x**) permission spot respectively. ![Verifying the SUID bit](https://adamtheautomator.com/wp-content/uploads/2023/11/image-42.png) Verifying the SUID bit 5\. Run the below `cat` command to test the currently logged-in user’s permission to access the _`/etc/shadow`_ file. This file is a critical system file that stores encrypted user passwords and related information, which only a root user can access. By default, the `cat` command lets you view the contents of a file in Linux. But this behavior doesn’t always hold true for every file. ```bash cat /etc/shadow ``` The message below appears since the current user does not have permission to access the file. ![Viewing the /etc/shadow file’s content via a user without appropriate permissions](https://adamtheautomator.com/wp-content/uploads/2023/11/image-41.png) Viewing the _/etc/shadow_ file’s content via a user without appropriate permissions 6\. Now, run each command below to switch (`su`) to the new user (`A-user`), and try accessing the `/etc/shadow` file again. This time, the `cat` command runs with the permissions of the file owner (usually root) rather than the permissions of the user who executed the command. ```bash # Switch to A-user su A-user # View the contents of the /etc/shadow file cat /etc/shadow ``` Since you temporarily granted permission to A-user to read the contents of that file, you’ll get an output like the one below. ![Viewing the /etc/shadow file’s content](https://adamtheautomator.com/wp-content/uploads/2023/11/image-40.png) Viewing the _/etc/shadow_ file’s content 7\. For security reasons, execute the following commands to `exit` out of the current user (A-user) and revert the permissions of the `cat` command to its original state. ```bash exit sudo chmod u-s /usr/bin/cat ``` ![Removing the SUID bit from the cat command](https://adamtheautomator.com/wp-content/uploads/2023/11/image-39.png) Removing the SUID bit from the `cat` command 8\. Finally, run the below command to verify that the SUID bit has been removed. ```bash stat /usr/bin/cat ``` Notice that the SUID bit **4** and **s** are no longer in the access permissions. ![Confirming the SUID bit removal](https://adamtheautomator.com/wp-content/uploads/2023/11/image-38.png) Confirming the SUID bit removal ## Enabling Collaborative Workflows in Linux Directories (SGID) Executing files with special permissions in Linux via SUID undoubtedly works well. But what if you aim for collaborative workflows, where multiple users collaborate on projects? Typically, you must ensure that newly created files inherit the group ownership of the parent directory. When confronted with this scenario, the SGID proves to be the game-changer. This powerful feature simplifies the management of shared resources and enhances group-based workflows in Linux environments. To see how the SGID works, you’ll create a group, add users to it, set SGID permission on a directory, and test its functionality as follows: 1\. Execute the following commands to log in as the root user and create a new group named `demo` (arbitrary). This group is what you’ll use to test the SGID functionality. These commands do no ```bash # Switch to root sudo su # Create a new group groupadd demo ``` ![Switching to root and creating a job](https://adamtheautomator.com/wp-content/uploads/2023/11/image-57.png) Switching to root and creating a job 2\. Next, run the commands below to create two users (`userA` and `userB`) that you’ll use to simulate a collaborative environment. ```bash useradd -s /bin/bash userA passwd userA useradd -s /bin/bash userB passwd userB ``` ![Creating users with passwords for simulating a collaborative environment](https://adamtheautomator.com/wp-content/uploads/2023/11/image-56.png) Creating users with passwords for simulating a collaborative environment 3\. After creating new users, run the below `usermod` commands, which don’t produce output to the terminal but add the users (`userA` and `userB`) to the `demo` group. ```bash usermod -aG demo userA usermod -aG demo userB ``` 4\. Now, execute each command below, create a directory (`mkdir`) called `/demo-dir` (arbitrary), and set the directory’s user and group ownerships to `userA` and `demo`, respectively. > 💡 _When successful, these commands don’t produce output, which applies throughout this tutorial._ ```bash # Create a directory mkdir /demo-dir # Change the directory's ownership chown userA:demo /demo-dir ``` 5\. Next, run the following `ls` command to view the permissions of the `/demo-dir` directory. ```bash ls -ld /demo-dir/ ``` The output below verifies the _**/demo-dir**_ directory’s user is set to **userA** and the group to **demo**. ![Viewing the /demo-dir directory’s permissions](https://adamtheautomator.com/wp-content/uploads/2023/11/image-55.png) Viewing the _/demo-dir_ directory’s permissions 6\. With verified permissions, run the `chmod` command below to set the SGID bit on the `/demo-dir/` directory as follows: * `g+s` – Set the SGID bit on the `/demo-dir/` directory. * `o-rwx` – Remove all permissions (read, write, execute) for others. * `u+rwx` – Grant read, write, and execute permissions to the owner. * `g+rwx` – Grant read, write, and execute permissions to the group. ```bash chmod g+s,u+rwx,g+rwx,o-rwx /demo-dir/ ``` 7\. Once SGID is set, run the following command to verify the permissions of the `/demo-dir` directory. ```bash stat /demo-dir ``` If successful, you’ll see the SGID bit set, represented by the number `2` before the octal mode permission and `s` in the group owner execute (`x`) permission spot (`rws`). ![Verifying the SGID bit set to the /demo-dir directory](https://adamtheautomator.com/wp-content/uploads/2023/11/image-54.png) Verifying the SGID bit set to the _/demo-dir_ directory 8\. Next, run each command below to create a `/home` directory for `userA`. ```bash mkdir /home/userA chown userA:userA /home/userA ``` 9\. Execute the following commands to switch (`su`) to `userA` and create a file (`touch`) called `textA.txt` (arbitrary) in the `/demo-dir` directory. These commands have no output (which applies throughout this tutorial), but you’ll verify the file’s permissions in the following step. ```bash # Switch to userA su - userA # Change directory cd /demo-dir # Create a text file touch textA.txt ``` 10\. Run the below `ls` command to view the permissions of the `textA.txt` file. ```bash ls -l textA.txt ``` Below, the _**textA.txt**_ file’s group owner is **demo**, which is the primary group of the creator, **userA**. Members of the **demo** group can read and modify the file, while others can only read it. To ensure new files in the /demo-dir directory inherit the directory’s group ownership, an SGID bit should be set on the directory, which you’ll cover in the following steps. ![Verifying the textA.txt file’s permissions](https://adamtheautomator.com/wp-content/uploads/2023/11/image-53.png) Verifying the _textA.txt_ file’s permissions 11\. Now, invoke the following commands to `exit` out of the current user (userA) and set the SGID bit (`chmod g+s`) in the `/demo-dir` directory ```bash # Exit userA exit # Set SGID to /demo-dir chmod g+s /demo-dir ``` ![Setting the SGID bit to the /demo-dir directory](https://adamtheautomator.com/wp-content/uploads/2023/11/image-52.png) Setting the SGID bit to the _/demo-dir_ directory 12\. Once SGID is set, run the below command to verify the SGID bit you added to the `/demo-dir` directory. ```bash stat /demo-dir ``` As shown below, you’ll notice the SUID bit **2** is added, and there is an **s** in the group owner execution spot. This output confirms the SGID bit has been successfully set to the _**/demo-dir**_ directory. ![Verifying the SGID is set to the /demo-dir directory](https://adamtheautomator.com/wp-content/uploads/2023/11/image-51.png) Verifying the SGID is set to the _/demo-dir_ directory 13\. Next, switch back to `userA` and create another file called `testA.txt` (arbitrary) in the `/demo-dir` directory. ```bash # Switch to userA su - userA # Change directory cd /demo-dir # Create a text file touch testA.txt ``` 14\. Once created, run the `ls` command below to check the ownership of the new file (`testA.txt`). ```bash ls -l testA.txt ``` If the SGID works as expected, the output shows that while **userA** is the owner, the group ownership is **demo** due to the SGID bit set on the _**/demo-dir**_ directory. ![Verifying permissions of the testA.txt file](https://adamtheautomator.com/wp-content/uploads/2023/11/image-50.png) Verifying permissions of the _testA.txt_ file 15\. Now, create a `/home` directory for `userB` for further testing the SGID functionality. ```bash mkdir /home/userB chown userB:userB /home/userB ``` 16\. Switch to `userB` and create a file called `testB.txt` (arbitrary) in the same `/demo-dir` directory. ```bash # Switch to userB su - userB # Change directory cd /demo-dir # Create a text file touch testB.txt ``` ![Switching to userB and creating the testB.txt file](https://adamtheautomator.com/wp-content/uploads/2023/11/image-49.png) Switching to userB and creating the _testB.txt_ file 17\. View (`ls`) the new file’s (`testB.txt`) information. ```bash ls -l testB.txt ``` Check the ownership of the _**textB.txt**_ file. ![Checking the ownership of the textB.txt file](https://adamtheautomator.com/wp-content/uploads/2023/11/image-48.png) Checking the ownership of the _textB.txt_ file ## Protecting Files Within Directories (Sticky Bit) Enabling collaborative workflows in Linux directories promotes teamwork and seamless collaboration. But when you must establish a secure environment for managing files effectively, the Sticky Bit permissions will do the trick. By setting the Sticky Bit, you’re essentially putting the “keys to the castle” in the hands of the file owner, directory owner, or root user. Doing so ensures that only they have the authority to delete or rename the file within the directory, providing an additional safeguard for sensitive data. To set Sticky Bit permissions, you must first create a shared directory with the following steps: 1\. Log in as the root user and create a (shared) directory (`mkdir`) where multiple users can create files. ```bash # Switch to root sudo su # Creata a directory (shared) mkdir /shared-dir ``` 2\. Next, run the below commands to change the permissions of the _`/shared-dir`_ directory to grant write permissions to everyone. The first number (`1`) in `1777` sets the Sticky Bit, while the rest (`777`) makes the directory readable, writable, and executable by everyone. ```bash # Change permissions, set Sticky Bit chmod 1777 /shared-dir # View the directory's permissions ls -ld /shared-dir ``` The following are features or attributes of the Sticky Bit in a Linux system:
FeatureFunction
Directory ProtectionWhen the Sticky Bit is set on a directory, it allows only the owner of a file within that directory to delete or rename their own files. Other users, even if they have write permissions to the directory, cannot delete or rename files owned by other users.
Shared DirectoriesThe sticky bit is handy for directories that are shared among multiple users. For example, on a system with a /tmp directory used by all users to store temporary files, setting the Sticky Bit prevents users from accidentally or maliciously deleting files owned by other users.
Below, you can see the letter ‘**t’** in the latter part of the permission field, which indicates the Sticky Bit is set to the _**/shared-dir**_ directory. ![Viewing permissions of the /shared-dir directory](https://adamtheautomator.com/wp-content/uploads/2023/11/image-47.png) Viewing permissions of the _/shared-dir_ directory 3\. Switch to `userA` and create a file called `fileA.txt` (arbitrary) in the `/shared-dir` directory: ```bash # Switch to userA su - userA # Create a text file touch /shared-dir/fileA.txt ``` 4\. Exit out of userA, switch to `userB`, and create another file called `fileB.txt` (arbitrary) in the same `/shared-dir` directory. ```bash # Exit userA exit # Swtich to userB su - userB # Create a text file touch /shared-dir/fileB.txt ``` 5\. Now, exit `userB`, switch to `userA`, and attempt to delete `userB`‘s `fileB.txt` file. ```bash # Exit userB exit # Switch to userA su - userA # Delete a file owned by userB rm /shared-dir/fileB.txt ``` You’ll get an output like the one below since only the file owner can make changes or delete the file. ![Attempting to delete a file (fileB.txt) owned by another user (userB)](https://adamtheautomator.com/wp-content/uploads/2023/11/image-46.png) Attempting to delete a file (_fileB.txt_) owned by another user (userB) 6\. Finally, run the following command list (`ls`) all files within the shared directory (`/shared-dir`). ```bash ls /shared-dir/ ``` If the Sticky Bit permissions work, you’ll see the _**fileB.txt**_ file created by userB is safe and sound and hasn’t been deleted. ![Confirming the fileB.txt file still exists](https://adamtheautomator.com/wp-content/uploads/2023/11/image-45.png) Confirming the _fileB.txt_ file still exists ## Conclusion As you wrap up this exploration of special permissions in Linux, you’ve unlocked a robust set of tools: the SUID, SGID, and [Sticky Bit](https://en.wikipedia.org/wiki/Sticky_bit). Armed with this knowledge, you can now fine-tune access control and safeguard your files with precision. But don’t stop here! Why not try setting up a shared directory with SGID and experiment with how files inherit group ownership? The Linux world is your oyster, and with each endeavor, you’ll master the art of securing your system with finesse! Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fspecial-permissions-in-linux%2F&text=Special%20Permissions%20in%20Linux%3A%20SUID%2C%20SGID%2C%20%26%20Sticky%20Bit)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fspecial-permissions-in-linux%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fspecial-permissions-in-linux%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/09/Practical-Linux-Unix-Tee-Commands-for-the-Linux-Admin.jpg) ### [Master Unix tee Commands for Real-World Linux Admin Tasks](/unix-tee/) Simplify Linux output management and streamline your workflow with the “Unix tee” command. This tutorial guides you through its practical applications. ![](https://adamtheautomator.com/wp-content/uploads/2024/03/openldap-4.jpg) ### [How to Install and Configure an OpenLDAP Ubuntu Server](/openldap/) Unlock the power of OpenLDAP on Ubuntu for centralized user authentication, seamless access control management, and enhanced directory services! ![](https://adamtheautomator.com/wp-content/uploads/2024/03/pipe-command-in-linux-1.jpg) ### [Unleashing the Power of the Pipe Command in Linux](/pipe-command-in-linux/) Unlock the prowess of the pipe command in Linux to streamline tasks, boost productivity, and simplify complex operations effortlessly! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)