准备

vim app.js

var fs = require('fs')

fs.writeFile('app.txt', 'hello node', function() {
    console.log('finish')
})

setuid

setuid: run with the privileges of the file owner

whoami
# op

ls -l `which node`
# -rwxr-xr-x 1 op op 45626872 Jan  7  2020 /home/op/.nvm/versions/node/v12.14.1/bin/node

node app.js
# finish

ls -l app.txt
# -rw-rw-r-- 1 op op 10 Mar 11 20:36 app.txt

sudo chown root:root `which node`

ls -l `which node`
# -rwxr-xr-x 1 root root 45626872 Jan  7  2020 /home/op/.nvm/versions/node/v12.14.1/bin/node

node app.js
# finish

ls -l app.txt
# -rw-rw-r-- 1 op op 10 Mar 11 20:42 app.txt

sudo chmod u+s `which node`
sudo chmod 4755 `which node`

ls -l `which node`
# -rwsr-xr-x 1 root root 45626872 Jan  7  2020 /home/op/.nvm/versions/node/v12.14.1/bin/node

node app.js
# finish

ls -l app.txt
# -rw-rw-r-- 1 root op 10 Mar 11 21:10 app.txt

系统应用: sudo

sudo chown `whoami`:`whoami` `which node`

ls -l `which node`
# -rwxr-xr-x 1 op op 45626872 Jan  7  2020 /home/op/.nvm/versions/node/v12.14.1/bin/node

id
# uid=1000(op) gid=1000(op) groups=1000(op),27(sudo)

ls -l `which sudo`
# -rwsr-xr-x 1 root root 149080 Feb  1  2020 /usr/bin/sudo

sudo `which node` app.js
# finish

ls -l app.txt
# -rw-r--r-- 1 root root  10 Mar 11 21:12 app.txt

sticky

sticky: the files in that directory can only be removed by the owner

whomai
# op

mkdir public

touch public/op.txt

ls -l public
# -rw-rw-r-- 1 op op 0 Mar 11 21:19 op.txt

sudo useradd other

sudo su other

touch /home/op/public/other.txt
# touch: cannot touch '/home/op/public/other.txt': Permission denied

exit

chmod 777 public

sudo su other

touch /home/op/public/other.txt

ls -l /home/op/public
# -rw-rw-r-- 1 op    op    0 Mar 11 21:19 op.txt
# -rw-rw-r-- 1 other other 0 Mar 11 21:22 other.txt

rm /home/op/public/op.txt

whoami
# op

chmod +t public
chmod 1777 public

ls -l
# drwxrwxrwt 2 op op 4096 Mar 11 21:25 public

touch public/op.txt

ls -l public
# -rw-rw-r-- 1 op op 0 Mar 11 21:26 op.txt

sudo su other

rm /home/op/public/op.txt
# rm: cannot remove '/home/op/public/op.txt': Operation not permitted

系统应用: /tmp

whoami
# op

ls -l / | grep tmp
# drwxrwxrwt  11 root root       4096 Mar 11 21:26 tmp

touch /tmp/op.txt

ls -l /tmp/*.txt
# -rw-rw-r-- 1 op op 0 Mar 11 21:29 /tmp/op.txt

sudo su other

rm /tmp/op.txt
# rm: cannot remove '/tmp/op.txt': Operation not permitted