chmod 4755
chmod 4755 sets rwsr-xr-x: everyone can run the program, and the setuid bit (the s) makes it run with the file owner's user ID, so a root-owned 4755 binary runs as root no matter who starts it.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | Yes | 7 |
| Group (g) | Yes | No | Yes | 5 |
| Others (o) | Yes | No | Yes | 5 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read, modify and run | List, enter, create, delete and rename entries |
| Group (g) | Read and run | List, enter and open entries |
| Others (o) | Read and run | List, enter and open entries |
Special bits in this mode
- setuid (4000): a program runs with the user ID of the file owner, not of whoever starts it. Linux gives it no meaning on directories and ignores it on scripts.
Facts
| Octal | 4755 |
|---|---|
| Symbolic | rwsr-xr-x |
| ls -l, file | -rwsr-xr-x |
| ls -l, directory | drwsr-xr-x |
| Equivalent symbolic command | chmod u=rwxs,go=rx |
| Default umask that creates it | None of the common umasks; set it explicitly with chmod |
| How Git records a file with it | 100755 (executable) |
| Special bits | setuid |
When to use it
- System programs that must do one privileged thing on behalf of any user: passwd is -rwsr-xr-x root so it can update /etc/shadow when you change your own password; su and mount are setuid root for similar reasons.
- Only for compiled programs written and audited for it, which drop privileges as soon as they can.
When not to use it
- Scripts: Linux ignores setuid on interpreted scripts (see execve(2)), so the bit silently does nothing.
- Giving a user root access to one command: a sudoers rule is logged, can be limited to specific arguments, and does not change the file.
- Filesystems mounted nosuid, which many distributions use for /tmp, /dev/shm and removable media: the bit is ignored there.
- Any program that can spawn a shell, write arbitrary files or load plugins: making it setuid root hands root to every local user.
Auditing setuid and setgid files
Unexpected setuid files are a classic sign of compromise or of a misconfigured install. List them periodically and compare against what your distribution ships.
sudo find / -xdev -type f -perm -4000 -exec ls -l {} + 2>/dev/null # setuid
sudo find / -xdev -type f -perm -2000 -exec ls -l {} + 2>/dev/null # setgid
sudo chmod u-s /usr/local/bin/tool # remove setuidCommands
sudo chmod 4755 /usr/local/bin/tool
sudo chmod u=rwxs,go=rx /usr/local/bin/tool # same resultstat -c '%a %A %n' /usr/local/bin/tool # Linux (GNU stat): 4755 -rwsr-xr-x
stat -f '%Mp%Lp %Sp %N' /usr/local/bin/tool # macOS and BSDApplying it to a whole tree
Never apply 4755 recursively. Setuid belongs on individual, audited binaries; on a tree it would turn every file into a program that runs as its owner and Linux gives the setuid bit no meaning on directories.
Frequently asked questions
- What does the s in rwsr-xr-x mean?
- The setuid bit (octal 4000), shown in the owner execute slot. Lowercase s means execute is also set; uppercase S (as in 4644, rwSr--r--) means setuid without execute, which does nothing useful.
- Is chmod 4755 dangerous?
- On a root-owned binary it is as dangerous as the program's worst bug, because every local user can run it as root. Use it only for well-audited system programs.
- Does setuid work on shell scripts?
- No. The Linux kernel ignores setuid and setgid on scripts that start with #!. Use sudo with a specific rule, or a small compiled wrapper, instead.
- Why did the setuid bit disappear after I edited the file?
- Linux clears setuid and setgid when an unprivileged process writes to the file, and chown clears them as well. Set it again with chmod u+s after the change.
Last reviewed by Arielton Oberek.