Permissions · Lesson 8

The Sticky Bit

Learn how the sticky bit protects entries in shared writable directories such as `/tmp`.

A writable directory normally lets an authorized user remove or rename entries within it, even when that user does not own the files themselves. The sticky bit adds an ownership restriction that makes shared writable directories safer.

How the Sticky Bit Restricts Removal

When a directory has the sticky bit set, Linux generally permits an entry to be removed or renamed only by a suitably privileged process, the directory owner, or the entry owner. Ordinary directory write and search permissions are still required.

The restriction concerns directory entries. It does not prevent a file owner from editing file contents when the file's permissions otherwise allow that operation, and it does not make the directory private.

In a sticky shared directory, which ordinary user can normally remove a particular entry?

Recognizing the Bit on `/tmp`

The system temporary directory is a common example:

$ ls -ld /tmp
drwxrwxrwt 17 root root 4096 Dec 15 11:45 /tmp

The final lowercase t occupies the other execute position. It means that both the sticky bit and other execute permission are present. An uppercase T means the sticky bit is set while other execute permission is absent.

Because /tmp is commonly writable and searchable by everyone, multiple users can create entries there. The sticky bit prevents an ordinary user from removing another user's entries merely because the directory is world-writable. Applications must still create temporary objects securely because predictable names, unsafe links, and weak file modes create separate risks.

What does lowercase t at the end of a directory mode indicate?

Setting and Removing the Sticky Bit

Set the bit symbolically:

$ chmod +t shared-directory

In a leading special-bits octal digit, sticky contributes 1:

$ chmod 1777 shared-directory

The leading 1 sets sticky, while 777 supplies the ordinary mode. This mode is appropriate only when the directory is intentionally shared by all local users. For a team directory, narrower group permissions may be preferable. Remove only the sticky bit with chmod -t shared-directory.

Which leading octal value represents the sticky bit?

Verifying the Complete Directory Policy

Sticky does not grant write or search access; it only restricts removal and rename after ordinary permissions permit directory modification. Verify the directory's owner, group, ordinary mode, ACLs, and mount context together. Test with nonprivileged accounts in an isolated environment rather than altering /tmp on a working system.

Does adding the sticky bit make a nonwritable directory writable to other users?

For practice, create a disposable shared directory, set an appropriate ordinary mode and sticky bit, then test entry removal as two nonprivileged users. The Delete and Move Files lab can reinforce the underlying rename and deletion operations.

Lesson complete

You finished The Sticky Bit

You can now explain and verify the sticky bit on shared directories.

Relate sticky to ownership restrictions on removal and rename.
Recognize lowercase t and uppercase T in a long listing.
Set the bit symbolically or with leading octal value 1.
Evaluate sticky together with ordinary directory permissions.

Keep your learning progress

Create a free account to save this lesson and continue learning on any device.

Create a free account

Back to Permissions