YanoSecA listing shows s where you expected an executable's owner-execute letter x. That difference can mean the program runs with an identity different from the person who started it. Read the metadata before drawing a security conclusion.
SUID abbreviates set-user-ID. For an eligible Linux executable, this bit can make its process use the file owner's effective user identity. Effective identity is the identity used for many access decisions. Here you inspect fictional listings only; no privileged program is supplied or run.
Before you begin
- Recommended first
- Install Ubuntu LTS and open a terminal, Where practice is allowed, Read, write, execute, and chmod, Files, programs, and processes, Owner, group, and chown
- Estimated time
- 15 min reading, 15 min activity. Setup and optional practice may take longer.
- Where you work
- Use Bash in your owned Ubuntu practice environment as an ordinary user. The supplied text files use UTF-8, a text encoding; where shown, LC_ALL=C requests consistent text ordering. Work only under your own new ~/yanosec-lab directory, never a host share or personal/system file. Refuse an existing exercise destination rather than overwriting it. No account, paid platform, or remote target is required. Optional extensions take about 10–15 minutes and are not part of the time above. A virtual machine is optional. You can also finish the reasoning from the printed evidence.
- Without a lab
- The page supplies the files, source and text records needed for the activity. Without a shell, follow the numbered steps on paper, label each result as predicted, and use the separate evidence supplied by the question. Running commands can wait until your lab is available. Reading works without JavaScript. Answer checking needs JavaScript and a secure context, such as HTTPS; saving a correct result also needs usable browser storage. Missing tools, managed or mobile hosts, or a deferred guest setup never require buying a service. Keep owned lab files for review; do not use broad deletion.
After this lesson you can:
- Locate a SUID marker in a regular executable's owner triplet.
- Explain the possible effective-identity transition and its constraints.
- Separate a review candidate from a proven exploitable flaw.
01Example
These fictional listings describe root-owned executables. No program is supplied or executed. Compare the owner-execute position in the two modes: the position changes even though the owner and group remain the same.
Normal: -rwxr-xr-x root root helper-normal
SUID: -rwsr-xr-x root root helper-special
Owner-execute position: x versus s
Review question:
How does this program use its effective identity?
The listing alone does not show an exploitable flaw.02The marker and its boundary
The type character comes first in a mode listing. In the following owner triplet, lowercase s occupies the execute position when both owner-execute and set-user-ID bits are present. Uppercase S shows set-user-ID without owner-execute. A similar marker in the group triplet describes a different bit.
Who owns the file matters. If the owner is root, a permitted identity transition can give the new process root's effective identity. A non-root owner gives a different identity. Neither case alone shows that the program contains a flaw or lets a user perform unintended actions.
Linux may suppress the transition. For example, a filesystem can be mounted with nosuid, a setting that disables these privilege transitions. The no-new-privileges process setting and some tracing conditions also matter. Linux ignores set-user-ID bits on interpreter scripts. A printed mode does not reveal all those conditions.
A defensive review asks why the program needs that identity, who can change its code, and how it handles untrusted input. Reducing unnecessary privilege requires an approved change. This lesson only identifies questions for a review; it asks for no execution, exploitation or special-bit change.
Align owner-execute metadata x and s; the SUID marker creates a review question, not proof of a vulnerability.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
| Field | Normal metadata | SUID metadata |
|---|---|---|
| Type | - | - |
| Owner triplet | rwx | rws |
| Group triplet | r-x | r-x |
| Other triplet | r-x | r-x |
| Owner | root | root |
| Owning group | root | root |
| Filename | helper-normal | helper-special |
The s occupies the owner-execute position in this fictional row.
The s occupies the owner-execute position in this fictional row.
Follow the explanation
- The s occupies the owner-execute position in this fictional row.
- Review how the program uses its effective identity; the listing alone does not show an exploitable flaw.
Read every state and value
1. The s occupies the owner-execute position in this fictional row.
- Selected Comparison
- position
- Highlighted Field
- Owner triplet
2. Review how the program uses its effective identity; the listing alone does not show an exploitable flaw.
- Selected Comparison
- limits
- Highlighted Field
- Owner triplet · Group triplet · Other triplet
03Try the metadata comparison
Read only the supplied normal and special helper rows. Split the type character from the three permission triplets, then compare the same owner-execute position. Searching for the letter s anywhere in a filename would not answer this metadata question.
Write one possible identity effect and one fact still missing. The listing supplies an owner and mode, but not the program's behavior or all execution restrictions. The same reasoning works on paper without inspecting unfamiliar executables on your device.
Compare an executable identity marker
Use the same owner-execute position in both example rows. Effective
identity is the identity used in many permission decisions. SUID can
change that identity on eligible execution, but metadata alone cannot
show unsafe program behavior or establish an exploitable flaw.
No program is supplied or executed.
Normal example: -rwxr-xr-x root root helper-normal
SUID example: -rwsr-xr-x root root helper-special
Owner triplet is positions 2-4 after the file-type character.
lowercase s: set-user-ID bit plus owner execute bit in this listing.
uppercase S: set-user-ID without that owner execute bit.
Linux execution restrictions can suppress identity transitions.
Question regular executable mode: -rwsr-x--- analyst learners tool
Which owner-execute-position marker indicates SUID: s or x?
Download the printed SUID case; no privileged program included
- Separate the type character and owner/group/others triplets in both rows. Mark the owner execute position.
- Identify which row adds the identity-changing bit. Expected: helper-special is the review candidate; helper-normal has ordinary owner execute metadata.
- Write a hypothesis and a limit: the process may use the owner's effective identity, but actual restrictions and code behavior must be checked in an authorized review. Do not claim a vulnerability from the mode.
- Name one defensive question, such as whether the helper needs that privilege. Stop after the written comparison; no binary was run or file mode altered.
04Users and permissions module case
The mode-owner case combines identities, access classes and a SUID clue. Apply the ordinary-mode assumptions stated in the card. Begin by assigning analyst, mira and zoe to owner, group or others before deciding read/write rights.
Check your note: analyst can read/write; mira, a non-owner learners member, can read; zoe gets neither right. Explain how chmod differs from chown, then identify the helper's review clue. Finish by naming missing program and execution evidence. This written review needs no account or file change.
Bring identity and mode evidence together
Assign each actor to one class before deciding rights. Next distinguish
permission-bit changes from ownership changes. For the helper, state
one possible identity effect and one missing fact. Use only printed
metadata; no privileged executable is supplied.
Original printed case.
Assume ordinary mode checks; no ACL/override; accessible parent paths.
File: -rw-r----- analyst learners report.txt
Actors: analyst (owner); mira (non-owner in learners); zoe (neither).
Helper metadata: -rwsr-xr-x root root review-helper (no binary provided).
Decide each actor's read/write rights; distinguish chown from chmod;
identify the helper's review clue; explain why metadata alone does not
prove exploitability or authorization to execute it.
05Optional challenge
Allow about ten extra minutes. Compare the same SUID mode on a root-owned executable and an ordinary-user-owned executable. Explain how the owner changes the possible effective identity. Add one condition that could suppress the transition and one reason the bit alone cannot prove an exploitable flaw.
06Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
SUID card A: fictional metadata onlyOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Columns: mode | owner | owning group | filename
-rwxr-sr-x | root | team | alpha
-rwsr-x--- | rina | team | beta
-rwxr-xr-x | root | team | gamma
All three entries are regular executable files. No program is supplied or run.
SUID card B: independent execution predictionsOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Caller identity in every case: nico, an ordinary non-root user.
Case P: native executable; owner elio; mode -rwsr-xr-x.
Case Q: native executable; owner root; mode -rwxr-xr-x.
Case R: native executable; owner root; mode -rwsr-xr-x; filesystem uses nosuid.
Execution is permitted in all three cases. The only identity-changing mechanism
under consideration is SUID. For P no restriction suppresses that transition.
For Q there is no SUID bit. For R nosuid suppresses that transition.
These supplied assumptions describe predictions, not observed execution.
SUID card C: independent review boundaryOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
An authorized inventory records: -rwsr-xr-x | root | auditors | report-helper
The record contains no source code, execution trace or input-handling evidence.
It does not describe mount options or other execution restrictions.
SUID card D: optional changed file typeOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Linux file: an interpreter script, not a native executable.
Owner: root. Displayed mode: -rwsr-xr-x. Caller: tal, an ordinary user.
Consider only whether Linux honors the script file's displayed SUID bit.
No separate privileged launcher or other identity-changing mechanism is present.
07Separate a privilege clue from a finding
Optional self-check: describe the review you would need before calling a SUID executable exploitable.
Check your explanation: locate the owner-position marker; identify the file owner; state the eligibility and execution restrictions that affect a transition; ask how the code uses that identity and handles input. A listing establishes metadata, not an unintended privileged action.
08Common mistakes
If you identify a group-position marker as owner SUID, split the triplets before inspecting. The question names the owner execute position specifically.
If s is treated as a vulnerability verdict, separate metadata from actual privilege behavior and program logic. Keep the exercise printed rather than executing a review candidate.
If you think a script with the bit must gain the owner identity on Linux, check the execution rules. No privileged binary, interpreter experiment or setuid mode change is supplied.
References
- Ubuntu 24.04 packaged manual: chmod(1)
Use the named command and option sections. This manual describes Ubuntu 24.04 packages; your installed version can differ. The lesson supplies the facts needed for its activity.
- Ubuntu 24.04 packaged manual: execve(2)
Use the named command and option sections. This manual describes Ubuntu 24.04 packages; your installed version can differ. The lesson supplies the facts needed for its activity.