Skip to content

Chapter 2 of 6

Special Permission Bits and chmod Patterns

The standard rwx bits cover most situations, but Linux also defines three additional flags that change the meaning of executable files and shared directories. The setuid bit, set with chmod u+s or as the leading 4 in a four-digit octal mode such as 4755, causes a program to run with the file owner's identity rather than the caller's — /usr/bin/passwd is the canonical example, written numerically so that ordinary users can change their own password while the program runs as root. Used carelessly, setuid is dangerous; modern kernels offer capabilities as a more focused alternative that grants only specific privileges instead of full root.

The matching setgid bit on a directory (chmod g+s dir) makes new files and subdirectories created inside it inherit the directory's group, which is invaluable for collaborative trees like a shared/ workspace. A third flag, the sticky bit (chmod o+t, or leading 1 in four-digit octal, as in 1777) is what gives /tmp the mode rendered rwxrwxrwt: every user may create files there, but only the file's owner (and root) may delete or rename them, even though the directory itself is world-writable. This single mechanism keeps one user's temporary files safe from another user on a shared host.

Short symbolic forms are often quicker than four-digit octal. The shorthand chmod u=rwx,g=,o= file sets the owner to full rwx and clears every other class, which is equivalent to chmod 700 file. When these special bits interact with mount options, the kernel still wins. Filesystems mounted with noexec prevent any program inside from being executed, even when the execute bit is set — a common hardening for /tmp to stop malware that tries to run from there. nosuid similarly ignores any setuid bits on the mount, which is why the same idea is sometimes applied to user-writable areas. In these cases it is the mount, not chmod itself, that governs effective behavior.

All chapters
  1. 1Reading and Converting Permission Modes
  2. 2Special Permission Bits and chmod Patterns
  3. 3Ownership, chown, and Recursive Patterns
  4. 4SSH, Immutable Files, and Sensitive Data
  5. 5POSIX ACLs, Filesystem Attributes, and Capabilities
  6. 6Diagnostics, Mounts, and Mandatory Access Control

Drill it

Reading is not remembering. These come from the Linux File Permissions And Chmod Patterns deck:

Q

What does <code>rwxr-xr--</code> mean?

Owner: rwx (7).Group: r-x (5).Other: r-- (4).Octal: 754.

Q

Convert <b>644</b> to symbolic.

rw-r--r-- — owner read+write, group read, others read.

Q

Convert <b>755</b> to symbolic.

rwxr-xr-x — typical for executables and directories.

Q

Convert <b>600</b> to symbolic.

rw------- — typical for private files like ~/.ssh/id_ed25519.