chmod 733: Blind Drop Directories and What They Miss

A drop box directory is one where people submit things and cannot see each other's submissions. 733 produces that: write plus execute gives the right to create entries and to resolve names, while the missing read bit means ls returns permission denied. Assignment hand-in directories and one way upload spools are the usual reason anyone reaches for it.

The gap is deletion. Write permission on a directory covers creating, renaming and removing entries, and it is not limited to entries you own. Someone who guesses or learns a filename can delete or overwrite another person's submission even though they can never list the directory. The mode looks tight and is not.

The fix is the sticky bit, giving 1733. With the sticky bit set, only the file's owner, the directory's owner or root may remove or rename an entry, which turns a fragile drop box into a usable one. This is the same mechanism that makes /tmp safe to share, and it is the reason /tmp is 1777 rather than 777.

Even with the sticky bit, a drop box is not confidential. A submitter can overwrite their own file, and a determined user can probe for names by attempting to create files and observing which attempts fail. If confidentiality of the submission list matters, the right answer is an application that owns the directory outright, not a directory mode.

On a file, 733 is meaningless. Write without read gives an account the ability to destroy the contents without ever seeing them, and the execute bit on a file nobody can read only works for compiled binaries. If you have arrived at 733 on a file, something applied a directory mode to the wrong thing.