Hey, folks, in this video, we are going to learn the special permissions that can be set to files
in directories using set, UID, set, group ID and sticky bit.
We all know permissions on a file or directory are referred to as bits.
So when you do the listing of files and directories, you will see each file or directory has read,
write and executable permission, and all of them are in three different categories.
The first set set of bits, the three are categorized for users, the person who's creating their file.
The second one is for the group and the third one is for others.
Now all of these are referred to as bits and you could change these bits by running.
Which command?
Yes, by change Mod command.
Now there are three different additional permissions in.
The first one is set UID.
This is a bit that tells Linux to run a program with the effective user ID of the owner instead of the
executable.
So for example, if you run a command as a regular user, the command password, you will see that command
is actually being run by root because root has to update the AC shadow file and a regular user does
not have permissions to update their AC shadow file.
That is why that sticky bit sorry, that set UID is assigned to that program.
Similarly, there is another one set group ID which tells the Linux to run a program with effective
group ID of the owner instead of the executable, and the examples of couple of commands are locate
or war command.
If you do ls minus L on locate or wall, you will see.
Those bits assigned to these programs.
Please note these bits are present for only files which have executable permissions.
And remember one thing.
These set UID set group ID, these are not the actual command that you would run to set these bits.
You will run the same command change mod to set the UID and group ID.
Then the third one is sticky bit.
This is a bit set on files and directories that allows only the owner or route to delete those files
or directories.
All right.
Moving on to assign special permissions at a user level, you could do change mod user plus s.
This is to set user ID of a program to assign special permissions at a group level.
You would do the same thing, change mod, but use G plus S and the program to remove these special
permissions at a user or group level.
You will use minus sign at you or groups or minus sign at the group to remove these set UID and set
group ID.
To find all executable in Linux, the set, UID and set group ID permission.
You can run the command, find slash, perm slash 6000 type F.
So let's go into our Linux machine.
And I am logged in as myself.
I am in my host and wish directory I'm in.
We have confirmed that now.
If I do, which.
Password.
This is the command you will see.
It is located in slash user bin.
Directory.
So when you do LS minus L slash user slash bin.
Slash password.
You will see.
That right here.
You see this little se right here which is assigned at the user level.
This is the set UID that is assigned to this command.
So if you are running a command, as I saw, for example, if I run password command, it is running.
Now I'm going to open up another terminal in the background right here and now if I check.
The process of password.
Command.
You will see it is being run by root right here.
By the way, the last one you could just ignore is just for the color, but you will see it is running
by root, even though it is run by I of soul.
That's why we set these set uid first user so it could run by the user who owns that command.
All right.
So I'm going to just do control D out of it.
Control C out of it so I could stop the program.
Now, if I want to find all the commands in Linux system that are set with these special permissions,
I could become root.
And I could do find slash, dash, perm, slash 6000.
These are the permissions type.
F this is just a command which will run and it will give you all these commands in Linux that have the
set, UID and set group ID if you pick anyone.
So let's say LS minus L and you do user bin locate, you will see right here this bit set to S, which
is set as the at the group level.
All right, moving on.
So one more thing please note very important.
These bits work on C programming executables, not on bash shell script.
So if you if you are creating a bash shell script, these bits will not work on them.
They will only work any program that is being written in C or C++ languages.
All right.
Now let's talk about the sticky bit.
It is assigned to the last bit of permissions.
So here we have our bits, read, write, executable, and you'll see the last one.
C Right here.
T That is the sticky bit assigned to that file or a directory.
Now, why do we need to assign the sticky bit?
So for that we will take an example of our slash temp directory in our temp directory.
If you do ls minus L on temp you will see there is a sticky bit assigned to it.
So let's go to our Linux machine again.
And let's clear the screen and we'll go into the temp.
Derek Sorry, we go into the CD slash directory and we'll do Les minus L and right here you'll notice.
So you hit this tea?
This tea means there's a sticky bit assigned to temp directory because every one, any user in the system
can write to this directory.
But that user, even though that user has a right permissions, cannot delete that directory.
This is a way to protect that directory for accidental deletion from the system.
All right.
So let's do some lab exercise to go over our sticky bits.
So first thing first will become root.
So I already have a root right here.
I'm logged in as root.
Who am I?
Am root.
I'm going to go into slash directory and I'm going to create a directory mkdir here.
And we created all in one.
I move this a little to the right.
You'll see right here.
Hit enter this.
Confirm the directory is there?
Yes, that directory is here.
The next thing is a sign or read.
Write an executable permission to that directory to do that.
We have to do change.
Mod seven, seven, seven slash all in one directory.
Now this directory should have read, write and executable at all levels.
Let's confirm that list minus TR and you will see.
This has all the permissions that it needs now become ISIL and create a directory inside of that all
in one directory.
So I'll go into that and I am logged in here as I have solved.
So I'll go into all in one directory and here I will create a directory called Imron, dear.
That's my directory.
All right, Very good now.
Give all the permissions to that directory.
So I'm giving the permission to that directory.
Change mod 777 Imron Directory.
It means anyone can come in and write or create files or directories inside of this directory.
Okay.
Now next step is create three files in that directory.
Okay, we'll create.
Let's go into that directory first and we'll create three files A, B, and C, Let's verify those files
are created.
Beautiful.
Yes, they are created.
Now let's go into the next step.
Open another terminal and log in Spiderman.
So I have a terminal open right here.
I'm logged in here as root.
I will become Spiderman.
Spider-Man.
It's a user account that's been created on this Linux machine.
If you do not have that account, you could go ahead and create it now, but I'm sure you will have
that account.
Let's become Spider-Man.
Let's confirm if you are logged in as Spider-Man by running.
Who am I?
Yes, we are now in.
The next step is go to all in one directory and delete Imron directory.
Okay, so let's go into Sorry right here.
I'm Spider-Man right here, Slash.
All in one directory and I'm going to delete remove our f Imron directory.
Bom.
See, it's gone now.
Maybe the Spider-Man did not want to delete that and accidentally deleted that.
Now how do we avoid this to happen?
Now for that we have do as I'm saying.
You will see the directory is deleted so now become root again and assign sticky bit to that all in
one right here I am.
Who am I?
I am Spiderman.
Let's exit out.
And now who am I?
I am root Now go to slash directory Find out where that all in one.
It's right here all the way at the bottom.
Now we are going to assign the sticky bit to it.
And to do that we have to do change mod and to assign a sticky bit you have to run plus t simply that
plus t to all in one that's verified.
The sticky bit has assigned.
Yes, we have verified C right here.
This little T This shows that it has to keep it assign beautiful moving on now become i absol and create
a directory again the same directory and we will change mod to seven, seven seven and create those
three files.
All right.
So we'll go here and first of all, we'll make sure we are logged in as I have saw.
Great.
And we'll go into all in one directory here I will create make directory Imron dear, I will change
the permission to have all the rights executables or reading permissions to that directory.
Beautiful.
Let's confirm that.
Yes.
Now let's create three files inside of this.
Let's go into the directory, touch A, B and C, three files are created.
Beautiful.
Now let's go to the next step.
Become Spiderman user again.
And now let's see if we could delete that directory, since now it has the sticky bit.
A sign.
Here we are, we are root.
Let's exit out of route.
And now.
Sorry, let's become Spiderman.
So Spiderman and enter the password.
Beautiful.
Now let's go to all in one directory and this one has a directory called Imron Directory that I created
as myself.
Now let's see me as a Spider-Man at this time if I could delete that directory.
Ah f Imran directory bom See, it says Operation permitted.
That's why you actually assign the permissions.
So if you do.
CDOT, go one step back and look at D.R. Even though you have given all the rights read, write executables
to this directory all in one.
But anyone who tries to delete the contents inside of this directory, it will not be permitted.
Why?
Because we have assigned this sticky bit to it.
That's the advantage of having a sticky bit.
I'll see you in the next lecture.