Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

Sticky bit are mentioned in every UNIX security book, but I couldn't find anyone that describes the exploitation of Sticky Bit set on a file.

Can you?

share|improve this question
4  
What do you mean? Are you looking for the uses of sticky bits on files? Are you looking for the security risks in enabling sticky bits (most modern unices ignore them anyway)? If you're curious about what you read in a particular book, it would help to summarize here what you read. P.S. Are you sure you mean sticky bits (which aren't particularly security-related) and not setuid/setgid bits (which definitely are)? – Gilles Nov 21 '11 at 18:45
cp /usr/bin/lua /usr/bin/crontab - if permissions allow the user to write the file would create an instance of lua running as root – symcbean Nov 22 '11 at 17:14
Is it possible you mean the setuid bit, not the sticky bit? They are very different. Please read the manual, and Google on them to do some background research before asking here: there has been a lot written on this subject. – D.W. Nov 23 '11 at 3:46
@D.W.: No. Since I never take anything for granted I just tried this out on a RH5.1 box - it worked exactly as I expected. (yes I was refering the setuid bit rather than the sticky bit) – symcbean Nov 23 '11 at 10:31
@symcbean, well, time for me to eat crow. I was the one who was confused. My sincere apologies. It turns out this is OS-dependent (C2 OS's are required to clear the setuid/setgid bits any time a file is written), but Linux does not clear setuid bits when the file is written, if the file is written by root. (That said, if the attacker can get access to the root account, then there are a million ways for the attacker to do really bad things, setuid bit or no.) What is true on Linux is that the setuid bit is cleared if a non-root user writes the file or if root makes the file writeable by others. – D.W. Nov 23 '11 at 17:03

1 Answer

up vote 5 down vote accepted

man chmod #Debian Linux

RESTRICTED DELETION FLAG OR STICKY BIT

The restricted deletion flag or sticky bit is a single bit, whose interpretation depends on the file type. For directories, it prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the directory; this is called the restricted deletion flag for the directory, and is commonly found on world-writable directories like /tmp. For regular files on some older systems, the bit saves the program's text image on the swap device so it will load more quickly when run; this is called the sticky bit.

Note that the "on some older systems" part applies to various BSD systems. Linux has never had any special handling for the sticky bit on files. See http://en.wikipedia.org/wiki/Sticky_bit for more detail about that.

From a security standpoint, it's really just about understanding why that permission exists on the /tmp directory, and possibly others. It prevents users from deleting the files of others in a directory that can be written to by multiple users. It's really only an issue if you don't set it and somebody gets delete happy on others' files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.