chmod 1777

chmod 1777 sets the mode to rwxrwxrwt: the permissions of 777 plus the sticky bit, the leading 1. On a directory, every user can create files, but only a file’s owner, the directory’s owner or root can delete or rename it. That’s the mode of /tmp, /var/tmp and /dev/shm. The t in the others’ execute slot shows the sticky bit with execute; a capital T, as in 1776 (rwxrwxrwT), means sticky without it.

$ stat -c '%A %a %U:%G %n' /tmp
drwxrwxrwt 1777 root:root /tmp

Why 777 isn’t enough

In a plain 777 directory, write on the directory is all it takes to delete or replace a file, so any user could remove another user’s files or swap in their own. The sticky bit closes that, while leaving the directory open to everyone for creating files.

What it doesn’t protect

• Reading. A file in /tmp is as readable as its own mode says. mktemp creates files as 600 and directories as 700, with unpredictable names; use it instead of a fixed path like /tmp/myapp.lock, which another user can create first.
• Links. A symlink planted in a shared directory is a classic attack. Linux’s fs.protected_symlinks, on in most distributions, refuses to follow a symlink in a sticky world-writable directory unless the follower owns it or it belongs to the directory’s owner.
• Files. On a regular file, Linux ignores the sticky bit.

Restoring /tmp

A careless chmod -R or a restored backup can strip the bit, and then anyone can delete everyone’s temp files. Put it back:

sudo chown root:root /tmp
sudo chmod 1777 /tmp     # chmod +t /tmp adds only the sticky bit

When /tmp is a tmpfs, the mount sets the mode: tmpfs /tmp tmpfs mode=1777,nosuid,nodev 0 0 in /etc/fstab.

A team drop directory

For a directory that only one group shares, combine the sticky bit with setgid and drop others: chmod 3770 gives rwxrws--T. Members can add files, every file lands in the group, and each member can delete only their own.

In services and containers

• systemd: PrivateTmp=yes gives a service its own /tmp and /var/tmp, so other services can’t see or tamper with its temp files.
• Docker: a tmpfs mount defaults to mode 1777; --mount type=tmpfs,destination=/tmp,tmpfs-mode=1770 narrows it.
• Git stores neither directory modes nor the sticky bit, so a directory that needs it has to get it at deploy or build time.