Sticky Bit in Linux: chmod +t, 1777 and Practical Examples

The sticky bit on a directory is a restricted deletion flag: users can add files, but they cannot remove or rename another user's entry unless they own the file, own the directory, or run with enough privilege. You see it on /tmp every day as the t in drwxrwxrwt.

Quick Reference: Sticky Bit Commands

1. What Is the Sticky Bit in Linux?

On directories, the sticky bit changes what directory write permission allows for deletion. Without sticky bit, a user with write and execute/search permission on the directory can generally remove directory entries even when they do not own the files themselves. With the sticky bit set, delete and rename are limited to:

• the file owner
• the directory owner (often root)
• root (or another privileged user)

Everyone else can still create new files. The kernel documents this as the restricted deletion flag in man chmod.

Root, the directory owner, and everyone else

Sticky bit targets unprivileged users who can write and search the directory. It does not stop cleanup by root or by the directory owner:

• Root bypasses normal file permission checks and can delete or rename any entry under /tmp, sticky bit or not
• Directory owner is allowed by the sticky-bit rule to delete or rename entries even when they do not own the file
• Other logged-in users with write and execute on the directory may create files, but may only delete or rename files they own

The bit is displayed in the others execute column (chmod +t is the same as chmod o+t), but the rule is not limited to the "others" rwx triplet. It applies to any user who is not the file owner, not the directory owner, and not root.

On very old Unix systems the same bit on executable files kept program text in swap so the next run started faster. Modern Linux with demand paging does not use sticky that way on files. Today you apply it to shared directories such as /tmp, not to binaries.

2. The shared desk: user1, user2, and sticky bit

Picture a open-plan office with one shared desk everyone is allowed to use. That desk is mode 777: anyone can walk up, drop a file on it, and read what is there. Linux calls that "write permission on the directory."

Without sticky bit, a user with write and execute on the desk can clear someone else's spot. user2 can legally throw user1's notebook in the bin because deleting a file is governed primarily by permissions on the parent directory, not by write permission on the file itself. user1 comes back from coffee, sees an empty spot, and files a ticket titled who deleted my notebook. Nobody confesses. HR is involved. Production is unaffected, but morale is not.

Turn on sticky bit and the desk gets a small sign: you may add your own stuff; you may only remove your own stuff. user1 and user2 can still leave files side by side. user2 can still delete user2_report_final_v9.pdf after realizing it was not final. What user2 cannot do is rm anything that belongs to user1, even on a world-writable path. Root owns the desk (/tmp is root-owned), so root can still clean house.

That is exactly what section 6 demonstrates with chmod 1777 and two accounts.

When sticky bit helps

• World-writable or group-writable folders where many users create files (/tmp, /var/tmp, shared upload spools)
• Application runtime directories where every service user drops sockets or PID files but must not touch neighbors
• Any "public inbox" directory where write must be open but cross-user deletes would be chaos

When you do not need it

• Private home directories (700) or project trees where only one Unix group should write anyway
• Single-owner paths where chown and normal rwx already limit who can enter the directory
• Regular files (sticky on a file is a historical footnote, not a modern access control tool)

If more than one unrelated account can create files in the same directory, sticky is the cheap seatbelt. If only your team should ever touch the tree, fix group ownership and mode first; you might never need +t.

3. Why /tmp Uses 1777

/tmp must let every user create scratch files, so the mode is world-writable. Without the sticky bit, any user with write and execute on the directory could delete anyone else's file in that path. Mode 1777 adds the sticky flag on top of 777:

• leading 1 — sticky bit (fourth special-permission digit in octal)
• 777 — read, write, execute for user, group, and other

Check the live modes on your system:

ls -ld /tmp /var/tmp

drwxrwxrwt. 58 root root 12288 Aug 15 19:13 /tmp
drwxrwxrwt. 14 root root  4096 Aug 15 18:36 /var/tmp

The t in the others execute slot means sticky is on and execute is set. 1777 is not the same as 777: plain 777 on a shared folder would let any writer delete any file inside it.

4. Set Sticky Bit with chmod +t

Symbolic mode is the safest way to add sticky without touching the existing rwx bits. The steps below run as a normal user under /tmp (default umask 022 on this host):

mkdir /tmp/sticky-demo

Apply sticky without changing the existing rwx bits:

chmod +t /tmp/sticky-demo

The sticky bit is a separate special-permission bit. ls -l displays it in the others execute position as t or T. Use chmod +t directory (or chmod o+t directory) to set it:

ls -ld /tmp/sticky-demo

drwxr-xr-t. 2 user user 6 Aug 15 19:27 /tmp/sticky-demo

mkdir left the directory at 755; +t added sticky without widening group or other write permission. Section 5 deliberately switches to 1777 for a /tmp-style mode.

5. Set Sticky Bit with Octal Mode 1777

Octal mode packs special bits into a fourth leading digit. For sticky on a directory that already has mode 755, use 1755:

chmod 1755 /tmp/sticky-demo

The listing should show lowercase t because others still have execute:

ls -ld /tmp/sticky-demo

drwxr-xr-t. 2 user user 6 Aug 15 19:27 /tmp/sticky-demo

For a world-writable shared inbox, set 1777 the same way /tmp does:

chmod 1777 /tmp/sticky-demo

Both sticky and world-writable show up as drwxrwxrwt:

ls -ld /tmp/sticky-demo

drwxrwxrwt. 2 user user 6 Aug 15 19:27 /tmp/sticky-demo

Use octal when you are setting the full mode in one shot. If the directory already has the right rwx bits, prefer chmod +t so you do not accidentally change owner or group permissions. See chmod recursive for broader mode changes.

6. How Sticky Bit Prevents Deleting Other Users' Files

Back at the shared desk: both users left a file, and user1 tries to bin user2's. Create a sticky world-writable directory and repeat the experiment:

mkdir /tmp/sticky-lab

Make it world-writable with sticky, like /tmp:

chmod 1777 /tmp/sticky-lab

As user1, create one file:

su - user1 -c 'touch /tmp/sticky-lab/user1_file'

Switch to user2 and add a second file:

su - user2 -c 'touch /tmp/sticky-lab/user2_file'

List both files before testing deletion:

ls -l /tmp/sticky-lab

total 0
-rw-r--r--. 1 user1 user1 0 Aug 15 19:13 user1_file
-rw-r--r--. 1 user2 user2 0 Aug 15 19:13 user2_file

Now try to remove the other user's file while logged in as user1:

su - user1 -c 'rm -f /tmp/sticky-lab/user2_file'

rm: cannot remove '/tmp/sticky-lab/user2_file': Operation not permitted

user1 can still delete user1_file. The sticky bit blocks cross-user deletes in the parent directory, which is why shared upload folders and /tmp rely on it. Root and the directory owner are not bound by that rule; either could remove user2_file for maintenance.

7. Lowercase t vs Uppercase T

ls -l shows sticky in the others execute position:

• lowercase t — sticky and execute for others (...x + sticky)
• uppercase T — sticky without execute for others

Set mode 750 with sticky to see uppercase T:

chmod 1750 /tmp/sticky-demo

Without execute on others, ls prints capital T:

ls -ld /tmp/sticky-demo

drwxr-x--T. 2 user user 6 Aug 15 19:27 /tmp/sticky-demo

Restore execute on others and the listing switches to lowercase t:

chmod 1755 /tmp/sticky-demo

Lowercase t confirms others regained execute:

ls -ld /tmp/sticky-demo

drwxr-xr-t. 2 user user 6 Aug 15 19:27 /tmp/sticky-demo

The bit is set in both cases. The letter case only tells you whether others still have execute.

8. Remove the Sticky Bit

Drop sticky with symbolic mode and leave the rest of the mode alone:

chmod -t /tmp/sticky-demo

Equivalent: chmod o-t directory. Confirm the t is gone:

ls -ld /tmp/sticky-demo

drwxr-xr-x. 2 user user 6 Aug 15 19:27 /tmp/sticky-demo

With octal, omit the leading 1 or use 0 in the special digit. Mode 755 on a directory that was 1755 clears sticky:

chmod 755 /tmp/sticky-demo

9. Find Directories with Sticky Bit

Sticky is bit 1000 in octal. find -perm -1000 matches directories where all bits specified by 1000 are set — in this case, that simply means the sticky bit is present:

find /tmp /var/tmp -maxdepth 1 -type d -perm -1000

/tmp
/tmp/.X11-unix
/tmp/.ICE-unix
/tmp/.XIM-unix
/tmp/.font-unix
/var/tmp

Narrow the search root on large systems. A full scan from / can take a while and may hit permission errors on paths you cannot read. More find patterns live in the find command cheat sheet.

Sticky Bit vs setuid and setgid

Linux has three special permission bits. They solve different problems:

chmod u+s and chmod g+s do not interact with sticky. For SUID, SGID, and full permission workflows, see Linux file permissions.

Summary

The sticky bit on a directory stops unprivileged users from deleting or renaming files they do not own, even when the directory is world-writable. That is why /tmp and /var/tmp ship as 1777 with a t in the listing.

Add sticky with chmod +t when you only want the flag, or bake it into the full mode with a leading 1 in octal (1755, 1777). Remove it with chmod -t or by dropping the 1 prefix. Lowercase t means others still have execute; uppercase T means sticky without execute.

Use find … -perm -1000 to audit sticky directories on a host. Sticky is not a substitute for setuid or setgid, and it is meant for shared folders, not for hardening individual files.

References

• man chmod
• man 7 inode (restricted deletion / sticky bit)
• GNU Coreutils chmod documentation