This is a quick guide on how to configure and use SGID, SUID and the sticky bit on Linux. I will not get into a lot of details, but I will add comments and notes that might help you understand or overcome a few common issues.
SUID - Set-user Identification
When a command or script with SUID bit set is run, its effective UID becomes that of the owner of the file, rather than of the user who is running it.
Note: SUID does not work on scripts that start with a shebang (
# chmod u+s [file] -rwsr--r--. 1 root root 0 Mar 16 21:48 test # chmod 4744 [file] -rwsr--r--. 1 root root 0 Mar 16 21:48 test
Note: A capital ’S’ (-rwSr–r–) indicates that the execute bit is not set
SGID - Set-group identification
SGID permission is similar to the SUID permission. The main difference is that when a script or command with SGID set is run, it runs as if it were a member of the same group in which the file is a member.
# chmod g+s [file] -rwxr-sr--. 1 root root 0 Mar 16 21:48 test # chmod 2754 [file] -rwxr-sr--. 1 root root 0 Mar 16 21:48 test
Note: A capital ’S’ (-rwxr-Sr–) indicates that the execute bit is not set
Anyone can write, but only the owner can delete the files (just like
Sticky bit is usually set on directories. Setting the sticky bit on a folder does nothing (on Linux).
Setting sticky bit
# chmod o+t [dir] -rwxr-r-t. 1 root root 0 Mar 16 21:48 test # chmod 1755 [dir] -rwxr-xr-t. 1 root root 0 Mar 16 21:48 test
- A capital ’T’ indicates that the execute bit is not set
- You should give write permission to make sure that the target users can write to the folder
Additional Special Permissions
. can represent special permissions (SELinux related).
+ indicates ACLs are applied.
Note: Octal mode is not an absolute translation to symbolic mode as symbolic changes only the specified permission set (user, group OR others), while octal overwrites all permission sets (user, group AND others)