Moving and deleting files in setguid folders

Question

I needed to replace my mail file with a cleaned version (all mail does on this machine is monitor cron jobs--so there's no reason not to delete mail more than 'n' days old).

The file has read/write permissions for my user account, with no rights to any other user or group. It's group ownership is mail group because the setguid bit is set on /var/spool/mail.

I was not a member of the mail group.

drwxrwsr-x  2 root    mail   4096 Sep  2 15:17 .
drwxr-xr-x 14 root    root   4096 May 10 09:27 ..
-rw------- 1  myuser  mail 219722 Sep  2 04:56 myuser

I couldn't move or delete this file until I made myself a member of the mail group.

My question is 'Why?'. Why would making myself, who shows to have permission to both read and write this file, a member of a group which has neither give me permission to move and delete it?

Answer 1

That's because rm, mv (and similar) involve modifying the directory structure and unless you have write (w) permission on that directory you can not do that.

This is irrelevant of the permission of the relevant file, you only need sufficient permission on the parent directory. Note that, the rm operation is actually the unlink(2) system call, which will just unlink the file from directory's file-inode mapping. While mv-ing within the same filesystem, rename(2) is executed which will map the file's inode on the new directory.

So as you can see all these requires modifying the parent directory, regardless of the file's own permission, so you need w permission on the directory for renaming/removing/creating new files.

Now, when the SETGID bit is set on a directory, all files on that diectory will be owned by the same group, the owner group of that directory.

In your case, /var/spool/mail directory is owned by root:mail with permission 775, with STDGID bit set, which will make all files under this directory to be owned by the same group, mail.

So as it stands, if you want to rename/remove myfile you need sufficient permission on the /var/spool/mail directory, either be root, or be a member of the mail group, the permission on myfile is irrelevant here as explained earlier.

Answer 2

I think this is because when you are moving or deleting a file the important permissions are the permissions of the parent directory. Since moving a file means creating a copy of the file and deleting the original, you would need the right permission on the directory to be able to do that. In this case, adding your user to the mail group would give you those necessary permissions.