|< Day Day Up >|
Recipe 9.7. Setting Up a Shared Directory with setgid and the Sticky Bit
This is how to set it with octal notation:
# chmod -v 2775 /shared-directory
You can also use symbolic notation:
# chmod -v +s /shared-directory
Keep in mind that +s sets both the setgid and setuid bits, which could be a security problem if executables or scripts are stored in this directory. chmod 2775 sets only the setgid bit.
Add the sticky bit to prevent anyone but the file owner from deleting the file, by using:
# chmod +t /shared-directory
# chmod 3775 /shared-directory
Any files created in the directory will have the same group owner as the directory. Any files copied into the directory will retain their original group ownership. Users must belong to a common group to access the directory. Files created in the directory will have permissions as determined by the umasks of the file owners.
A classic example of a directory making canny use of the sticky bit is /tmp:
$ stat /tmp ... Access: (1777/drwxrwxrwt) Uid: ( 0/ root) Gid: ( 0/ root)
/tmp needs to be world-readable and writable, but we do not want users or processes deleting temp files that do not belong to them. So the sticky bit takes care of that.
The setuid bit lets users run a command with the same permissions as the file owner. This is how ordinary users are able to change their own passwords, even though /etc/passwd can only be written to by root:
$ stat /usr/bin/passwd File: `/usr/bin/passwd' Size: 26584 Blocks: 56 IO Block: 4096 regular file ... Access: (4755/-rwsr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
Sticky bits have one other use. A long time ago, setting the sticky bit on an executable kept it in memory after execution had finished. In the olde Unix days of less sophisticated memory management and feebler hardware, this made programs start faster. These days, don't bother—it won't do a thing.
9.7.5 See Also
|< Day Day Up >|