Privileges & sudo

Privileges

Privileges are categorized in 3 kinds of users

  • User(u): the user that created the item

  • Group(g): users inside the group assigned to the item

  • Others(o): rest of users. not owners of the item

They then grant 3 types of permission

  • Read(r)

    • Files: allows user to see the contents of the file

    • Directories: allows the user to list the inside of the directory

  • Write(w)

    • Files: allows user to modify the contents of the file

    • Directories: allows the user to create, delete or rename files inside the directory

  • Execute(x)

    • Files: allows the use to execute the file

    • Directory: allows the user to access the directory (cd into it)

By default users have ownership of the item they create and the group assigned will be the main group of that user. User can change it to whatever groups is in.

If user is deleted file will still be property of the user, though it will show used UID and GUID of the late user.

source: linuxcommand.org

Special privileges

When an executable(binarie) has special privileges "setuid" it means that whoever executes it, will do as if it was the owner of the binarie. This is used for example in passwd to let users change their own passwords and edit sensible files like /etc/shadow as root, but in a controlled way as they can only edit their password not others.

Is shown as rws, if it's capitalized (rwS ) means it has no executable privileges in the first place, making it useless.

For groups we can use "setgid" and assign it to binaries and directories too, same as setuid, items assigned or created inside the folder (can also be recursive with -R) will be executed or created as the owner of the item.

Is shown as s/S same as setuid but in the group segment.

Sticky Bit

Its used to prevent users that are not the owner of the directory, owner of the file, or root, to delete a file from a designed directory.

Placed always on a directory, it will prohibit users -that are not the owner of a file- to delete anything inside the folder that's not theirs, meaning others could create or modify files in a more controlled and not so catastrophic way.

Useful for directories like /tmp where most users have access and deleting files from other users could be a problem.

Is shown at the end, in the "others" segment instead of "x", rwt if executable, rwT if not executable

Though useful, special permissions can easily become a vulnerability if not precisely configured, and a great vector for privilege scaling. Look for them when pentesting ;)

UMASK

(User Mask) By default items are created with a mask, usually 022, you can check it with umask (it will show an extra 0, 0002, it just means its in octal, some languages like Perl or C need it). But the starting privileges are different on directories and files, having directories more "flexible" privileges and files not being able to get executed by default for security reasons (scripts are dangerous!). Directories start at 777 and files at 666.

Directories: 777 - 022 = 755 (rwx,rx,rx)

Files: 666 - 022 = 644 (rw-,r,r)

You can change the umask temporary for a session with umask nnn

If you want it to be permanent you have to edit your shell profile, for example in bash you have to add umask nnn to your ~/.bashrc file and in zsh(used on Kali) you have to edit ~/.zshrc

You can check the shell you are currently using with echo $0 or the one you have assigned by default to your user with echo $SHELL

To change the umask of all users in the system you have to add the line to /etc/profile and restart, though it will probably be over-passed by specific user profiles.

Some distros use /etc/pam.d/common-session or /etc/login.defs

FACL

(File Access control List) They a are more advanced mechanism that standard privileges, with FACL we can define specific and detailed permissions to individual files for individual users or groups in a finer way. Use in combination with standard privileges for flexible management. They are represented as a "+" sign at the end of the privileges string in ls.

Useful, but they can be complex and conflict with standard privileges, so they amplify the human factor hackers love. Look for them trying to scale privileges ;)

SUDO

Allows us to execute commands as another use, most commonly as the superuser, known as root.

Basically lets low privileged users execute critical commands without giving them access to root.

Normally login as root is disabled, so to be the administrator of a computer you have to be in the sudo group or have (ALL : ALL) ALL privileges in the /etc/sudoers file.

sudoers file

Located on /etc/sudoers, Is the configuration file that determines which users or groups are allowed to execute which commands with elevated privileges or in other words with no restriction.

Its strongly recommended to edit it with the command visudo as it creates a temporal copy, sudoers.tmp, and checks for syntax errors before merging it with the original file.

Last updated