chmod 2755
chmod 2755 sets rwxr-sr-x: the owner has full access, group and others can read and execute, and the setgid bit makes a program run with the file's group or makes new entries in a directory inherit its group.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | Yes | 7 |
| Group (g) | Yes | No | Yes | 5 |
| Others (o) | Yes | No | Yes | 5 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read, modify and run | List, enter, create, delete and rename entries |
| Group (g) | Read and run | List, enter and open entries |
| Others (o) | Read and run | List, enter and open entries |
Special bits in this mode
- setgid (2000): a program runs with the file's group; on a directory, new files and subdirectories inherit the directory's group.
Facts
| Octal | 2755 |
|---|---|
| Symbolic | rwxr-sr-x |
| ls -l, file | -rwxr-sr-x |
| ls -l, directory | drwxr-sr-x |
| Equivalent symbolic command | chmod u=rwx,g=rxs,o=rx |
| Default umask that creates it | None of the common umasks; set it explicitly with chmod |
| How Git records a file with it | 100755 (executable) |
| Special bits | setgid |
When to use it
- Directories where one owner publishes files that must carry a specific group (for example a reports folder read by an analytics group) while group members only read.
- Programs that need one group's privileges and nothing more. Debian installs crontab as 2755 root:crontab so it can write into the spool directory; Fedora uses a setuid-root crontab (4755) instead. A setgid program is a smaller grant than setuid root.
When not to use it
- Scripts: Linux ignores setuid and setgid on interpreted scripts (execve(2)), so the bit does nothing except confuse audits.
- Programs that were not written to run with elevated privileges: any bug that lets a user write files or run commands does so with the group's rights.
- Shared folders where the group must write: use 2775.
Commands
sudo chmod 2755 /srv/reports
sudo chmod u=rwx,g=rxs,o=rx /srv/reports # same resultstat -c '%a %A %n' /srv/reports # Linux (GNU stat): 2755 drwxr-sr-x
stat -f '%Mp%Lp %Sp %N' /srv/reports # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 2755 and files to 644 separately:
sudo find /srv/reports -type d -exec chmod 2755 {} +
sudo find /srv/reports -type f -exec chmod 644 {} +Frequently asked questions
- What does rwxr-sr-x mean?
- Owner rwx, group r-x with the setgid bit (the s replaces the x), others r-x. In octal that is 2755.
- What is the difference between an s and an S?
- Lowercase s means setgid plus group execute. Uppercase S means setgid without group execute, which on a program is usually a mistake.
- Why did my setgid bit disappear?
- Linux clears setuid and setgid when an unprivileged process writes to the file, and chown clears them too. chmod also drops setgid on a file whose group you are not a member of.
Last reviewed by Arielton Oberek.