CATEGORY -LINUXlinux-permissions-referenceLinux Discretionary Access Control & Permissions

Linux File Permissions & POSIX ACLs

Rapid reference for standard POSIX file permissions (rwx), octal notation, special permission bits (SUID, SGID, Sticky), and getfacl/setfacl commands.

Primary Tool: auditctl

Core Purpose & Operating Context

Quickly decode, calculate, and audit Unix permission modes, SUID bits, and POSIX access control lists.

Quick Reference Values

r (Read)

4View file contents or list directory

w (Write)

2Modify file contents or create/delete files in directory

x (Execute)

1Run binary/script or traverse directory (cd)

SUID (Set Owner User ID)

4000 (u+s)Executes with file owner permissions

SGID (Set Group ID)

2000 (g+s)Executes with group permissions / inherits directory group

Sticky Bit

1000 (+t)Only file owner or root can delete files in directory

01.

Auditing Special Permission Bits

Locating binaries that run with elevated privileges or directories with shared group inheritance.

Find all SUID binaries across the entire filesystem

$find / -perm -4000 -type f 2>/dev/null

Flag Breakdown: -perm -4000: matches any file with SUID bit set; 2>/dev/null: silences permission errors

Find all SGID binaries

$find / -perm -2000 -type f 2>/dev/null

Flag Breakdown: -perm -2000: matches files with SGID bit set

Find all world-writable files (major security finding)

$find / -perm -2 -type f 2>/dev/null

Flag Breakdown: -perm -2: matches files writable by other/world

02.

POSIX Access Control Lists (ACLs)

Granular permissions beyond the standard owner/group/other model.

Inspect detailed ACL entries on a sensitive file

$getfacl /var/log/audit/audit.log

Grant user 'analyst' read-only permission without changing file group

$setfacl -m u:analyst:r /var/log/audit/audit.log

Flag Breakdown: -m: modify; u:user:perms: rule syntax

Remove all extended ACLs and restore standard POSIX permissions

$setfacl -b sensitive_file.conf

Flag Breakdown: -b: remove all extended entries

Defensive & Security Takeaways

•

SUID binaries owned by root execute as root regardless of the executing user's privileges.

•

Always audit GTFOBins against discovered SUID binaries during privilege escalation triage.

•

The sticky bit on /tmp prevents unprivileged users from deleting files owned by other users.

Authoritative Standards & Docs

POSIX.1e Draft ACL Standardman7.org

GTFOBins Curated SUID Referencegtfobins.github.io

Previous Cheat SheetLinux Container Isolation Primitives (cgroups & namespaces)

Next Cheat SheetLinux Privilege Escalation Triage