Purpose of the Sticky Bit in Linux Explained

This article explores the purpose and function of the sticky bit permission in the Linux operating system, focusing on its critical role in shared directories like /tmp. You will learn how the sticky bit prevents unauthorized file deletion in multi-user environments, how to identify it in permission strings, and how to apply or remove it using standard Linux command-line utilities.

In Linux, directory permissions govern the ability to create, delete, and rename files inside that directory. By default, if a directory grants write and execute permissions to all users (such as standard 777 permissions), any user can delete or rename any file within that directory, regardless of who owns the individual file. In a multi-user environment, this behavior introduces a significant security vulnerability.

Shared directories such as /tmp and /var/tmp require universal write access so that running applications and system users can create temporary files freely. However, without an extra layer of protection, one non-privileged user could tamper with, overwrite, or delete temporary files belonging to another user or a critical system service.

The sticky bit solves this problem by modifying standard deletion rules. When the sticky bit is applied to a directory, Linux restricts file deletion and renaming: a file within that directory can only be deleted or renamed by:

Even if an unauthorized user has write permissions to the parent directory, the operating system blocks any attempt to remove or rename files they do not own. Other operations, such as reading or modifying a file's contents, remain governed by the file's individual read and write permissions.

You can identify the sticky bit by inspecting a directory's permissions using the ls -ld command. For /tmp, the output typically resembles:

drwxrwxrwt 15 root root 4096 Oct 25 10:00 /tmp

The t character at the end of the permission string (drwxrwxrwt) indicates that the sticky bit is enabled and that execute permissions are also set for others. If the execute permission is absent for others, a capital T is displayed instead (drwxrwxrwT).

To set the sticky bit on a directory, use the chmod command with the symbolic flag +t:

chmod +t /path/to/directory

Alternatively, you can assign it using octal (numeric) notation by prefixing the permission mode with 1:

chmod 1777 /path/to/directory

To remove the sticky bit, run:

chmod -t /path/to/directory

By enforcing ownership-based deletion rules, the sticky bit provides essential access control that enables safe collaboration and temporary file storage across multi-user Linux systems.