chmod 2775: setgid directory (rwxrwsr-x)

Answer

chmod 2775 is 775 plus the setgid bit (the leading 2). On a directory, setgid makes every file and subdirectory created inside it belong to the directory's group instead of the creator's primary group. It is the standard setup for a directory a team edits together.

chmod 2775 = rwxrwsr-x: owner full access, group full access, others read and execute, plus setgid.

	Read 4	Write 2	Execute 1	Digit
Owner (user)	Owner (user) rr	Owner (user) ww	Owner (user) xx	7
Group	Group rr	Group ww	Group xx	7
Others	Others rr	Others w-	Others xx	5
Special	setuidsetuid	setgidsetgid	stickysticky	2

7
Owner (user): 7 = 4 read + 2 write + 1 execute
7
Group: 7 = 4 read + 2 write + 1 execute
5
Others: 5 = 4 read + 1 execute
2
Special bits: 2 setgid: a program runs with its group's rights; on a directory, new files inherit the directory's group

On a file

Owner (user) read it, change it and run it as a program
Group read it, change it and run it as a program
Others read it and run it as a program

On a directory

Owner (user) list the names inside, enter it and open files by name, create and rename and delete entries
Group list the names inside, enter it and open files by name, create and rename and delete entries
Others list the names inside and enter it and open files by name

chmod 2775 filechmod u=rwx,g=rwxs,o=rx filels -l → -rwxrwsr-x

What to know

Typical setup: groupadd devs, add the users, then chgrp devs /srv/project and chmod 2775 /srv/project. New files get group devs, and new subdirectories get the group and the setgid bit too, so the behavior continues down the tree.

Setgid fixes the group, not the permission bits. Whether teammates can edit a new file still depends on the creator's umask: under 002 new files are 664 and group-writable; under 022 they are 644 and only readable by the group. Use umask 002 for team members, or a default ACL (setfacl -d -m g::rwX).

Where it fits

Shared project, data or release directories for a team group
Web content directories that several deploy users write to
Directories a service and an admin group both write

Gotchas

Existing files are not changed. Fix a tree with chgrp -R devs dir and find dir -type d -exec chmod g+s {} +.
mv keeps a file's original group; cp creates a new file, which picks up the directory's group. Moved-in files may need chgrp.
GNU chmod does not clear setgid on a directory with a plain numeric mode: chmod 755 on a 2775 directory gives 2755. Use chmod g-s or chmod 00755.
Setgid on a regular file is different: the program runs with the file's group. In ls -l a capital S in the group slot means setgid without group execute.

Related explainers

← chmod calculator