SUID, SGID & sticky.
Beyond rwx there's a fourth octal digit holding three special bits. SUID makes a program run as its owner, SGID controls group behavior on files and directories, and the sticky bit protects shared directories like /tmp. Watch each one flip and see what changes.
SUID, SGID, and sticky bit animated tutorial. The fourth octal permission digit, setuid (run as owner), setgid on files and directories (group inheritance), sticky bit (shared directory delete protection), symbolic and octal chmod, find -perm. RHCSA EX200 ready.chmod 755 is secretly chmod 0755 — there's a fourth digit. It holds three bits that change how programs run and how shared directories behave.
- ·Comfortable with normal rwx permissions and octal (755, 644)
- ·Know the difference between owner, group, and other
- ·Helpful: the chmod calculator tool
Read and set SUID, SGID (on files and directories), and the sticky bit — in both symbolic and octal form — and audit for them with find.
pace: 9 minutes
Recap — the three normal triads
Standard permissions are three groups of rwx: owner, group, other. As octal that's three digits — 755 means rwx for owner, r-x for group, r-x for other. But there's a hidden FOURTH digit in front (usually 0) that holds the three special bits. chmod 755 is really chmod 0755.
The special bits reuse the execute slot in the symbolic view: SUID shows in the owner's x (s), SGID in the group's x (s), sticky in the other's x (t). Lowercase means the execute bit is also on; UPPERCASE means it isn't — almost always a mistake. When auditing a server, an unexpected SUID-root binary is the first thing an attacker plants and the first thing you should hunt for.
$chmod u+s file$chmod 4755 file$chmod g+s file_or_dir$chmod 2775 dir$chmod +t dir$chmod 1777 dir$chmod u-s file$chmod 0755 file$find / -perm /4000$find / -perm /2000$find / -perm /1000$find / -perm -4000 -user root$ls -l /usr/bin/passwd$stat -c '%A %a %n' file$rwsr-xr-x = 4755$rwxrwsr-x = 2775Why is /usr/bin/passwd SUID root?
You want every file created in /srv/project to be group-owned by 'developers', no matter who creates it. What do you set?
What does the sticky bit do on /tmp?
You see `-rwsr-xr-x` with a lowercase 's', versus `-rwSr--r--` with a capital 'S'. What's the difference?
These aren't graded — they're just for active recall, which is what actually makes the lesson stick.
chmod calculator
Toggle the special bits and watch the octal and symbolic forms update together — including the SUID/SGID/sticky digit you just learned.
Read this lesson as text6 chapters · quiz answers
01Recap — the three normal triads
Standard permissions are three groups of rwx: owner, group, other. As octal that's three digits — 755 means rwx for owner, r-x for group, r-x for other. But there's a hidden FOURTH digit in front (usually 0) that holds the three special bits. chmod 755 is really chmod 0755.
02SUID (4) — run as the file's owner
Set the leading digit to 4 and an executable runs with the OWNER's privileges, not the caller's. The classic example is /usr/bin/passwd: it's owned by root and SUID, so a normal user running it can update /etc/shadow (which only root can write). In symbolic form the owner's x becomes 's'. A capital 'S' means the bit is set but the underlying x is NOT — usually a mistake.
03SGID (2) on a file — run as the file's group
Leading digit 2 on an executable makes it run with the FILE's GROUP privileges. Less common than SUID but used by tools that need access to a specific group (e.g. /usr/bin/write running as the tty group). In symbolic form the group's x becomes 's'.
04SGID (2) on a directory — group inheritance
This is the one you'll actually use in production. Put SGID on a DIRECTORY and any new file created inside inherits the directory's GROUP, instead of the creator's primary group. Perfect for shared project folders: set the dir's group to 'developers' + SGID, and everything created there is automatically group-owned by developers — no matter who made it.
05Sticky bit (1) — shared-directory delete protection
Leading digit 1 on a world-writable DIRECTORY means: you can only delete or rename files you OWN, even though everyone can write to the directory. /tmp is the canonical example — anyone can create files there, but you can't delete someone else's. In symbolic form the other's x becomes 't'.
06Setting them — symbolic and octal
Two ways. Symbolic:
chmod u+s(SUID),chmod g+s(SGID),chmod +t(sticky). Octal: prepend the digit — 4755, 2775, 1777. To find files with a special bit set across the system (a common security audit), usefind / -perm /4000for SUID, /2000 for SGID, /1000 for sticky. An unexpected SUID-root binary is a red flag worth investigating.
Quiz — answers
- Why is /usr/bin/passwd SUID root?
- →So a normal user running it executes with root's privileges, letting them update /etc/shadow (which only root can write).Changing your password means writing to /etc/shadow, which is root-only. SUID lets the passwd binary run as its owner (root) regardless of who launched it, so users can change their own password without being root.
- You want every file created in /srv/project to be group-owned by 'developers', no matter who creates it. What do you set?
- →SGID on the directory (chgrp developers /srv/project && chmod g+s /srv/project).SGID on a DIRECTORY makes new files inherit the directory's group rather than the creator's primary group. Set the dir's group to developers and add g+s. (SUID on directories has no effect on Linux.)
- What does the sticky bit do on /tmp?
- →Although /tmp is world-writable, you can only delete or rename files you own — not other users' files.Without the sticky bit, write permission on a directory lets you delete ANY file in it. The sticky bit restricts deletion/rename to the file's owner (or root). That's why /tmp is drwxrwxrwt.
- You see
-rwsr-xr-xwith a lowercase 's', versus-rwSr--r--with a capital 'S'. What's the difference? - →Lowercase s = SUID set AND owner-execute set (normal). Capital S = SUID set but owner-execute is NOT set (usually a mistake — the bit can't do anything useful).The special bit reuses the same character slot as the execute bit. Lowercase = both special bit and execute are on. Uppercase = special bit on but execute off — which is almost always a mistake, since a non-executable SUID file does nothing.
keep going — these pair well with what you just learned.
SELinux contexts
Why Apache can't read your file. Watch the policy engine decide — and learn the workflow for fixing denials. RHCSA-ready.
Linux boot process
From power button to login prompt. Every stage in the chain — UEFI, GRUB, kernel, initramfs, systemd — with the rescue moves that save you. RHCSA-ready.
LVM stacking
Layer-by-layer build of an LVM stack: disks → PVs → VG → LVs → filesystem. Then extend live and snapshot. RHCSA-ready.