Setuid, setgid, and the sticky bit are special permission flags in Unix-like systems used to modify file and directory behavior. 1) Setuid allows a user to run a file with the owner’s permissions, often used for admin tasks via tools like passwd but poses security risks. 2) Setgid runs files with the group's permissions and ensures new files in a directory inherit the group ownership, useful for shared directories. 3) The sticky bit prevents users from deleting or renaming files in a directory unless they own them, commonly applied to public directories like /tmp. These flags should be used sparingly due to potential security vulnerabilities and privilege escalation risks.

Setuid, setgid, and the sticky bit are special permission flags in Unix-like operating systems that modify how permissions work for files and directories. They’re not as commonly used as the standard read/write/execute permissions, but they can be very useful — or dangerous if misused.

Let’s break down what each one does and when you might use them.

What is the setuid bit?

The setuid (Set User ID) bit allows a regular user to execute a file with the permissions of the file's owner instead of their own.

For example, imagine a script or program owned by root that needs to perform some administrative task. If you set the setuid bit on it, any user who runs that file will temporarily act as root.

When should you use it?

• Only when necessary — because it’s a security risk.
• Common real-world examples: tools like passwd, which lets users change their password (which involves editing system files only root can normally touch).

How to set it:

chmod u s filename

You’ll see it in ls -l output like this:

-rwsr-xr-x 1 root root 1234 Jan 1 00:00 filename

Note the s in the user (owner) execute field.

What is the setgid bit?

The setgid (Set Group ID) bit works similarly to setuid, but instead of running a file as the owner, it runs it as the group that owns the file.

It also behaves differently when applied to directories: new files created inside that directory will inherit the group ownership of the directory, not the primary group of the user who created them.

When should you use it?

• For shared directories where multiple users need to collaborate.
• Ensures files created inside stay within the correct group, even if different users are adding them.

How to set it:

chmod g s filename_or_directory

In ls -l, it looks like:

-rwxr-sr-x 1 root admin 1234 Jan 1 00:00 filename

Or for a directory:

drwxr-sr-x 2 root admin 4096 Jan 1 00:00 dirname

Again, the s appears — this time in the group execute slot.

What is the sticky bit?

The sticky bit isn’t about running files as someone else. Instead, it restricts deletion rights on directories.

When enabled, only the owner of a file (or root) can delete or rename it — even if others have write access to the directory.

When should you use it?

• On public directories like /tmp, where anyone can create files, but shouldn't be able to delete others' files.

How to set it:

chmod  t directoryname

In ls -l, it shows up like this:

drwxrwxrwt 2 root root 4096 Jan 1 00:00 tmp

You’ll notice a t at the end of the permission string.

A few things to keep in mind:

• These bits are powerful and can introduce security risks.
• Use them sparingly and always double-check permissions.
• Misuse can lead to privilege escalation vulnerabilities.
• You don’t usually need these day-to-day unless you're managing shared environments or writing system-level utilities.

So yeah, basically that's what setuid, setgid, and the sticky bit do — not complicated, but definitely worth understanding if you're working in a multi-user or system administration context.

The above is the detailed content of What are the setuid, setgid, and sticky bits?. For more information, please follow other related articles on the PHP Chinese website!