用户特殊权限SUID，SGID, SBIT理解学习

1、SUID（set user id）,设置用户的特殊权限，是针对可执行文件设置的特殊权限，使执行该文件的用户临时用于该文件所属主的权限。
1）使用root用户创建一个权限为0的文件，该文件只有root用户拥有可读可写权限
[root@RetHat home]# pwd
/home
[root@RetHat home]# touch file.txt
[root@RetHat home]# chmod 0 file.txt
[root@RetHat home]# ls -al file.txt
----------. 1 root root 0 Mar 21 13:37 file.txt
2)在file.txt中写入hello world！
[root@RetHat home]# echo ‘hello world!’ > file.txt
[root@RetHat home]# cat file.txt
hello world!
3）编写程序test.c，打开文件file.txt，将文件中的hello world!写入字符串buffer中，再输出buffer

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>

#define SIZE 128

int main()
{
    char buffer[SIZE];
    int fileDescriptor;
    int read_number;

    (void)memset(buffer, 0, SIZE);
    fileDescriptor = open("file.txt", O_RDWR);
    if (fileDescriptor == -1) {
        perror("open");
        return -1; 
    }   
    read_number = read(fileDescriptor, (void *)buffer, SIZE);
    if (read_number == -1) {
        perror("read");
        return -1; 
    }   
    printf("buffer is %s", buffer);

    return 0;
}

root用户下面执行a.out没有问题
[root@RetHat home]# gcc test.c
[root@RetHat home]# ls
a.out file.txt kongchi test.c
[root@RetHat home]# ./a.out
buffer is hello world!
4）切换普通用户，在执行a.out发生错误
[root@RetHat home]# su - kongchi
Last login: Sat Mar 21 13:55:59 CST 2020 on pts/0
[kongchi@RetHat ~]$ cd …
[kongchi@RetHat home]$ ls
a.out file.txt kongchi test.c
[kongchi@RetHat home]$ ls -al a.out
-rwxr-xr-x. 1 root root 8716 Mar 21 13:54 a.out
文件a.out的权限是0755，说明其他用户是可以执行的，但是发现执行时报错：
[kongchi@RetHat home]$ ./a.out
open: Permission denied
显示open函数调用失败，打开file.txt文件没有权限，上文中我们已经知道file.txt文件权限是0，除root用户外，均没有权限，原因就在此处。
5）要想普通用户kongchi也可以执行a.out，就需要使用SUID特殊权限，让执行a.out这个文件的用户暂时用于root的权限。
[kongchi@RetHat home]$ exit
logout
[root@RetHat home]# ls
a.out file.txt kongchi test.c
[root@RetHat home]# chmod u+s a.out
[root@RetHat home]# ls -al a.out
-rwsr-xr-x. 1 root root 8716 Mar 21 13:54 a.out
这时发现文件a.out的权限变为rwsr-xr-x，增加了特殊权限，其他用户执行a.out时会暂时拥有所属主的权限。
6）切换普通用户kongchi，执行a.out，显示hello world!，执行成功。
[root@RetHat home]# su - kongchi
Last login: Sat Mar 21 13:56:17 CST 2020 on pts/0
[kongchi@RetHat ~]$ cd …
[kongchi@RetHat home]$ ls
a.out file.txt kongchi test.c
[kongchi@RetHat home]$ ./a.out
buffer is hello world!
总结：SUID就是让其他用户对没有访问权限的文件（比如上文中提到的file.txt）有限制的读写，通过一个二进制的文件进行限制，在程序中做出读写的控制，而后把这个程序的所属者执行位设置为s。这样其他用户可以通过这个程序来对文件读写，做到了“有限制的读写”。

2、SGID（set group id）,让执行文件的其他用户暂时用于属组的权限（和上文暂时用于所有组权限一致）
1）file.txt的权限设置为
----rw----. 1 root root 26 Mar 21 17:23 file.txt
所属组root的权限可读可写
上述test.c文件编译产生的可执行文件a.out，root用户可以执行
[root@RetHat home]# gcc test.c
[root@RetHat home]# ls -al a.out
-rwxr-xr-x. 1 root root 8716 Mar 21 18:00 a.out
[root@RetHat home]# ./a.out
buffer is hello world!
2）可执行文件的权限rwxr-xr-x(755)，其他用户可以执行，执行切换用户xiaoxing，执行a.out报错，原因open函数调用失败。原因是file.txt文件对于其他用户是不可读不可写。
[root@RetHat home]# id xiaoxing
uid=1001(xiaoxing) gid=1001(xiaoxing) groups=1001(xiaoxing)
[root@RetHat home]# su - xiaoxing
[xiaoxing@RetHat ~]$ cd …
[xiaoxing@RetHat home]$ ls
a.out file.txt kongchi test.c xiaoxing
[xiaoxing@RetHat home]$ ls -al a.out
-rwxr-xr-x. 1 root root 8716 Mar 21 18:00 a.out
[xiaoxing@RetHat home]$ ./a.out
open: Permission denied
3）修改a.out文件的权限，让其他用户暂时用于该文件（a.out）所属组的权限。增加特殊权限后，xiaoxing用户执行a.out文件成功。
[root@RetHat home]# ls -al a.out
-rwxr-xr-x. 1 root root 8716 Mar 21 18:00 a.out
[root@RetHat home]# chmod g+s a.out
[root@RetHat home]# ls -al a.out
-rwxr-sr-x. 1 root root 8716 Mar 21 18:00 a.out
[root@RetHat home]# su - xiaoxing
Last login: Sat Mar 21 18:02:50 CST 2020 on pts/0
[xiaoxing@RetHat ~]$ cd …
[xiaoxing@RetHat home]$ ls
a.out file.txt kongchi test.c xiaoxing
[xiaoxing@RetHat home]$ ./a.out
buffer is hello world!
4）SGID就是创建共享目录，root在/home目录下面创建目录，给目录设置777全权限，再增加s权限，其他用户在此目录下面创建的文件的基本组都自动继承该目录所在的所属组root
[root@RetHat home]# ls
a.out file.txt kongchi test.c xiaoxing
[root@RetHat home]# mkdir family
[root@RetHat home]# chmod 777 family/
[root@RetHat home]# ls -ald family/
drwxrwxrwx. 2 root root 6 Mar 21 19:03 family/
[root@RetHat home]# chmod g+s family/
[root@RetHat home]# ls -ald family/
drwxrwsrwx. 2 root root 6 Mar 21 19:03 family/
[root@RetHat home]# su - kongchi
Last login: Sat Mar 21 19:01:36 CST 2020 on pts/0
[kongchi@RetHat ~]$ cd …/family/
[kongchi@RetHat family]$ touch kongchi.txt
[kongchi@RetHat family]$ ls -al kongchi.txt
-rw-rw-r–. 1 kongchi root 0 Mar 21 19:04 kongchi.txt
[kongchi@RetHat family]$ exit
logout
[root@RetHat home]# su - xiaoxing
Last login: Sat Mar 21 18:53:45 CST 2020 on pts/0
[xiaoxing@RetHat ~]$ cd …/family/
[xiaoxing@RetHat family]$ touch xiaoxing.txt
[xiaoxing@RetHat family]$ ls -al xiaoxing.txt
-rw-rw-r–. 1 xiaoxing root 0 Mar 21 19:05 xiaoxing.txt
对family设置SGID后，普通用户kongci在family目录中创建的文件kongchi.txt文件的所属组（基本组）是root而不是kongchi，同样xioaxing用户创建的xiaoxing.txt文件所组也是一样。

3、SBIT（Sticky Bit）,对一个目录设置此权限后，除root和文件所有者可以删除外，其他用户均不能删除，/tmp目录就设置了此权限。
[root@RetHat home]# ls -ald /tmp
drwxrwxrwt. 21 root root 4096 Mar 21 18:39 /tmp
[root@RetHat home]# su - kongchi
Last login: Sat Mar 21 18:32:33 CST 2020 on pts/0
[kongchi@RetHat ~]$ cd /tmp
[kongchi@RetHat tmp]$ touch test.txt
[kongchi@RetHat tmp]$ chmod 777 test.txt
[kongchi@RetHat tmp]$ ls -al test.txt
-rwxrwxrwx. 1 kongchi kongchi 0 Mar 21 18:49 test.txt
[kongchi@RetHat tmp]$ exit
logout
[root@RetHat home]# su - xiaoxing
Last login: Sat Mar 21 18:39:30 CST 2020 on pts/0
[xiaoxing@RetHat ~]$ cd /tmp
[xiaoxing@RetHat tmp]$ ls -al test.txt
-rwxrwxrwx. 1 kongchi kongchi 0 Mar 21 18:49 test.txt
[xiaoxing@RetHat tmp]$ rm -f test.txt
rm: cannot remove ‘test.txt’: Operation not permitted

普通用户kongchi在/tmp目录中创建文件test.txt，然后更改其权限为777，切换另一普通用户xiaoxing，去删除test.txt，删除失败，原因就是/tmp目录设置了特殊权限SBIT。