Beyond the nine rwx bits there is a fourth octal digit holding three special bits: setuid, setgid, and the sticky bit. You have seen them in ls -l as an s or t where an x would be:
setuid (4): run as the file's owner
A setuid executable runs with the owner's identity, not the caller's. The canonical example is /usr/bin/passwd: it is owned by root and setuid, so an ordinary user running it can update /etc/shadow (which only root can write) for the duration of that command. You will see -rwsr-xr-x; the s replaces the owner's x.
sudo chmod u+s /usr/local/bin/mytool # or: chmod 4755setuid on a program you do not fully trust is dangerous: any flaw in it becomes a root exploit. Set it sparingly, and never on a shell or interpreter.
setgid (2): run as the file's group, or inherit it on a directory
setgid does two different things:
- On an executable, it runs with the file's group.
- On a directory, new files created inside inherit the directory's group instead of the creator's primary group. This is the key to a shared project folder: everyone's new files stay group-owned by the team.
sudo chmod g+s /srv/project # or: chmod 2775 (directory: inherit group)You will see drwxrwsr-x on such a directory; the s is in the group's slot.
Sticky bit (1): only the owner can delete, in a shared directory
On a world-writable directory, the sticky bit means a file can only be deleted or renamed by its owner (or root), even though anyone can create files there. That is why /tmp is drwxrwxrwt: everyone can write, but you cannot delete someone else's temp files.
sudo chmod +t /shared/dropbox # or: chmod 1777The fourth digit, all together
In a four-digit octal mode, the leading digit is setuid (4) + setgid (2) + sticky (1):
| Mode | Bit | Typical use |
|---|---|---|
4755 | setuid | a trusted root helper like passwd |
2775 | setgid | a shared group directory |
1777 | sticky | a world-writable scratch dir like /tmp |
Audit setuid binaries (a real security task)
Attackers hunt for setuid binaries because each is a potential privilege-escalation path. List them:
sudo find / -perm -4000 -type f 2>/dev/null # all setuid files
sudo find / -perm -2000 -type f 2>/dev/null # all setgid filesCompare against a known-good baseline; an unexpected setuid binary (especially one not from a package) is a red flag. The find -perm syntax is covered in find files by owner, group, or permission.
FAQ
See also
- Linux file permissions explained: the base rwx bits these extend.
- How to create a group on Linux: setgid directories for shared teams.
- Find files by owner, group, or permission: audit setuid/setgid binaries with find -perm.
- Linux ACLs: getfacl and setfacl: finer-grained access than the bits.
Sources
Authoritative references this article was fact-checked against.
