Subject: Re: wu-ftpd: Re: Undeletable - how?

From: [email-masked] (William L. Sebok)
Date: Fri, 20 Mar 1998 11:07:29 -0500 (EST)

Someone said:
>On Unix systems setting the sticky-bit prevents anybody but the owner
>of the file from deleting it.
 
From: [email-masked] (Andy Church)
>      Looks like this behavior isn't standard:

And then goes on to show that Linux 2.0.23 does not have this behavior.

I am not sure about all of the systems that implement the directory sticky bit
but I can vouch that SunOS 4.X and Solaris 2.X have this behavior.  It blocks
quite a number of security holes involving hijacking files in /tmp.

Bill Sebok      Computer Software Manager, Univ. of Maryland, Astronomy
	Internet: [email-masked]	URL: http://www.astro.umd.edu/~wls/

---

From: [email-masked] (Alan J Rosenthal)
Date: Fri, 20 Mar 1998 11:18:49 -0500

>of the file from deleting it.
[someone else]
>      Looks like this behavior isn't standard:
[someone else]
>I am not sure about all of the systems that implement the directory sticky bit

Wait.  The sticky bit on the DIRECTORY prevents anyone but the owner of a file
IN the directory from deleting it.  You don't sticky-bit the file, you
sticky-bit the directory.  And the owner of the directory can still delete all
the files in it.  And linux implements this too.  I think the BSD folks
invented it, but it's been around for a long time and nearly everyone does it
these days.

Do "man sticky" on Sun OS or Solaris for an explanation; most versions of unix
implement this behaviour even though most versions don't have "man sticky".
The name of the bit derives from its original Thompson-Ritchie purpose, which
was to mark a binary such that it would not be released from memory even when
the last process using it exited; most versions of unix no longer implement
THIS behaviour but the name of the bit persists.

---

From: [email-masked] (Andy Church)
Date: Sat, 21 Mar 1998 09:03:44 EST

>>      Looks like this behavior isn't standard:
[example of deleting a file with sticky bit set]
>You didn't write to test...you wrote to your home directory.

     Yes, I'm well aware of that.  The original claim was either incorrect
or not clearly worded, and I (possibly mis-) understood it to be referring
to sticky bits on files.

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.