chmod 4755: setuid (rwsr-xr-x)
chmod 4755 is 755 plus the setuid bit (the leading 4). When anyone runs the program, it runs with the privileges of the file's owner rather than the user who started it. ls -l shows this as an s in the owner's execute slot: rwsr-xr-x.
chmod 4755 = rwsr-xr-x: owner full access, everyone else read and execute, plus setuid.
| Read 4 | Write 2 | Execute 1 | Digit | |
|---|---|---|---|---|
| Owner (user) | 7 | |||
| Group | 5 | |||
| Others | 5 | |||
| Special | 4 |
7Owner (user): 7 = 4 read + 2 write + 1 execute5Group: 5 = 4 read + 1 execute5Others: 5 = 4 read + 1 execute4Special bits: 4 setuid: a program runs with its owner's rights, not the caller's
On a file
- Owner (user) read it, change it and run it as a program
- Group read it and run it as a program
- Others read it and run it as a program
On a directory
- Owner (user) list the names inside, enter it and open files by name, create and rename and delete entries
- Group list the names inside and enter it and open files by name
- Others list the names inside and enter it and open files by name
chmod 4755 filechmod u=rwxs,go=rx filels -l → -rwsr-xr-x
What to know
/usr/bin/passwd is 4755 and owned by root. That is how an ordinary user can change their own password: the program runs as root, writes to /etc/shadow (which the user cannot touch directly), and is written to only change the caller's own entry. sudo, su and mount use setuid the same way.
Every setuid-root program is a potential privilege escalation, so systems keep the list short. List them with find / -xdev -perm -4000 -type f.
Where it fits
- System programs that must do one narrow privileged task for unprivileged users (passwd, sudo, su, ping on older systems)
- Rarely, in-house helpers that must run as a service account. Prefer sudo rules or capabilities (
setcap) instead.
Gotchas
- Linux ignores the setuid bit on scripts that start with
#!. It only works on compiled binaries. - A capital
S(rwSr-xr-x, mode 4655) means setuid is set but the owner has no execute bit, so the bit does nothing. - Filesystems mounted with
nosuid(common for /tmp, removable media and some container volumes) ignore setuid. - On Linux, changing a file's owner with
chownclears its setuid bit, so runchownbeforechmod 4755.
Related explainers
- chmod 755 (rwxr-xr-x)chmod 755 gives the owner read, write and execute, and everyone else read and execute. When to use it for...
- chmod 2775: setgid directory (rwxrwsr-x)chmod 2775 makes a directory shared: files created in it inherit its group. How to set up a team directory...
- chmod 1777: sticky bit (rwxrwxrwt)chmod 1777 is how /tmp is set: anyone can create files, but only a file's owner can delete or rename it....