Why can't one clear setuid/setgid/sticky bits via octal notation with chmod?

3

So today at work, management randomly shows up and asks me to give a crash course on using Linux to a group of engineers. Apparently, they've caught wind of my dissension from Microsoft (due to Win 10 privacy and security issues) and now I'm the resident "expert" for anything *nix.

After explaining to the group the beauty of Linux's simplicity, there are questions about file permissions. I explain chmod and the user-group-world octal syntax for assigning permissions.

Then on to the setuid/setgid/sticky bit -- I demonstrate with a simple example such as chmod 2755 somefile.txt and point out that the setgid bit is now enabled. To clear that bit, I issue chmod 0755, but to my dismay the setgid bit persists. What?? I know I've used that syntax to clear sticky bits before (albeit probably a decade ago). It was pretty embarrassing to find it didn't work right after I had talked up how elegant the design was.

Anyways, I also showed them the g+s and g-s alternative shorthand and discovered that g-s DID work.

After the presentation, I was thinking I had found a bug with chmod, but upon reviewing the man page I found that the behavior was "by design" as there is an explicit note stating that chmod can be used to set the sticky flags, but not clear them.

WHY was the ability for chmod to clear sticky bits using octal notation removed? I googled and found some people saying the leading zero was "confusing" and should be omitted. Really? By that logic, we might as well say that it is illegal for bytes (e.g. ASCII code) to contain leading "0" bits because it is "confusing". The people who find the leading zero confusing can use the symbolic notation. The people who want to use the octal notation should be able to use octal.

Why was chmod crippled to not support octal notation for clearing the sticky bits?

digitale

Posted 2016-09-22T02:15:10.830

Reputation: 129

what shell are you using? I can't reproduce your findings with BASH. Whatever the answer is, its likely the result of legacy-compatibility compromises. Unfortunately, there is almost never a canonical answer to "why" questions in regards to design choices. My guess is it is to protect against shells sending the leading zero implicitly, even when it might be undesirable. – Frank Thomas – 2016-09-22T04:04:20.207

Answers

2

The problem is that before the introduction of sticky bits, there were already many shell scripts etc. that just used three octal digits (or less). Also, the convention that any number can be padded with leading zeroes is fairly deeply entrenched.

So if one had allowed the octal form with a leading zero to reset the sticky bits, many scripts would have accidentally reset the sticky bits. Debugging that would have been a nightmare, so instead chmod ended up with the restriction that you can't reset sticky bits in octal form. After all, if you really want to reset them (which happens rarely), you can always use the alternate form.

So like many forms of surprising complexity, the answer is "backward compatibility".

dirkt

Posted 2016-09-22T02:15:10.830

Reputation: 11 627