title: POSIX ACLs and the 'sticky' bit applied to a directory
body: <p><a href="http://wt.tuxomania.net/publications/posix.1e/" rel="nofollow noreferrer">POSIX.1e</a> was going to define ACL (<a href="http://en.wikipedia.org/wiki/Access_control_list" rel="nofollow noreferrer">Access Control List</a>) mechanisms for POSIX (amongst other security-related issues), but the proposals were never converted to a formal standard.  Nevertheless, ACLs (not necessarily POSIX.1e ACLs) are supported at least optionally in all the main variants of Unix (<a href="http://www.cs.unc.edu/cgi-bin/howto?howto=linux-posix-acls" rel="nofollow noreferrer">Linux</a>, <a href="http://www.freebsd.org/doc/en/books/handbook/fs-acl.html" rel="nofollow noreferrer">BSD</a>, <a href="http://developer.apple.com/documentation/Darwin/Reference/Manpages/man1/chmod.1.html#//apple_ref/doc/man/1/chmod" rel="nofollow noreferrer">MacOS X</a><a href="http://developer.apple.com/documentation/Darwin/Reference/Manpages/man3/acl.3.html" rel="nofollow noreferrer">(ACL)</a>, <a href="http://www.docs.hp.com/en/5992-3387/ch06s03.html" rel="nofollow noreferrer">HP-UX</a>, <a href="http://publib.boulder.ibm.com/infocenter/systems/topic/com.ibm.aix.security/doc/security/security.pdf" rel="nofollow noreferrer">AIX</a> (p107ff), <a href="http://www.softpanorama.org/Solaris/ACL/index.shtml" rel="nofollow noreferrer">Solaris</a>).  One detail I've not yet spotted being discussed is how ACLs on files interact with the sticky bit on a directory.</p>
  
  <p>With a normal directory (no ACLs around to confuse the issue), the permissions can be set to, for example, 1777 (found on /tmp, for example).</p>
  
  <pre><code>drwxrwxrwt  16 root     sys         4819 May  4 12:09 /tmp
  </code></pre>
  
  <p>The sticky bit is indicated by the 't' in the last position of the permissions.  It means that a user can only delete a file from the directory if the user can write to the file.  This makes sense; if the user can write to the file, the contents of the file can be destroyed.</p>
  
  <p>My question is:</p>
  
  <ul>
  <li>Suppose the general (non-ACL) permissions of the /tmp directory are as illustrated above.</li>
  <li>Further suppose that a paranoid user, 'trembler', sets the non-ACL permissions on a file <code>/tmp/secret</code> to 600 (user 'trembler', group 'worried').</li>
  <li>Suppose that 'trembler' grants 'rw' access on /tmp/secret to another user, 'blase' via an ACL that cites 'blase' specifically.</li>
  <li><strong>Can 'blase' delete the file <code>/tmp/secret</code></strong></li>
  </ul>
  
  <p>If the ACL is taken into account, the answer should be 'yes'; if the ACL is ignored, the answer would be 'no'.  Assuming that ACLs are enabled on the relevant file system, is the behaviour uniform across all Unix variants?</p>