The Sticky Bit and Protected Append Patterns

In this lesson, you will learn how to use the "sticky bit" to secure shared directories by ensuring that users can only delete the files they personally own.

The Problem with World-Writable Directories

In a typical Linux system, the /tmp directory is "world-writable," meaning every user has permission to create files there. However, standard Linux permissions have a flaw: if a directory is writable by others, any user can delete or rename any file inside that directory, even if they don't own the file. This creates a security risk where a malicious user could delete critical temporary files created by other users or the system.

The Sticky Bit Solution

The "sticky bit" is a special permission bit that, when set on a directory, changes this behavior. When the sticky bit is active, a user can only delete or rename a file if they meet one of two conditions:

1. They are the owner of the file.
2. They are the owner of the directory (or the root user).

This effectively "locks" the files to their owners, preventing random users from cleaning up your work.

Implementing the Sticky Bit

You can identify if a directory has the sticky bit set by checking the permissions with ls -ld. Look for a t at the end of the permission string:

ls -ld /tmp
# Output looks like: drwxrwxrwt ... /tmp

The t in the final position indicates the sticky bit is active. To manually apply the sticky bit to a directory you’ve created for shared work, use the chmod command with the special +t flag:

# Create a shared project folder
mkdir /home/shared_project

# Set the sticky bit
chmod +t /home/shared_project

Alternatively, you can use the octal representation by adding 1 to the very front of the standard three-digit permission code (e.g., 1777 for a world-writable directory with the sticky bit).

By applying this simple flag, you create a "protected append" environment where collaboration is possible, but ownership integrity is strictly maintained.

Key Takeaway: The sticky bit prevents unauthorized file deletion in shared directories by restricting removal rights exclusively to the file owner.