SUIDSGID

SUID and SGID are special permission bits used in Unix-like systems to control the privileges with which a program runs. They are part of the file mode bits and affect how a process inherits user and group identities when the executable is started.

SUID, or Set User ID on execution, causes the executing process to run with the effective user ID of the file owner, rather than the user who started it. When the owner is root, this grants root privileges to the program while it runs. This mechanism is used for utilities that need higher privileges to perform a task, such as changing a user’s password or accessing restricted resources. A file with the SUID bit set typically appears with an rwsr-xr-x style in a long listing, where the owner’s execute bit is replaced by an s.

SGID, or Set Group ID on execution, makes the process run with the effective group ID of the file’s group. Like SUID, SGID can enable elevated access, but at the group level. When applied to directories, the SGID bit causes new files and subdirectories created within to inherit the directory’s group ownership, aiding collaborative workflows.

Security considerations are central to SUID/SGID usage. Incorrectly configured binaries can enable privilege escalation, and many systems minimize risk by limiting such bits, auditing their presence, or mounting filesystems with the nosuid option. On Linux, scripts commonly do not honor SUID/SGID, and executable scripts with these bits are generally discouraged.

Common management tasks include viewing with file listings, identifying with find -perm -4000, and setting bits with chmod u+s for SUID or chmod g+s for SGID. Ownership typically matters; owners are often root for privileged programs. Proper use requires careful validation to avoid introducing security holes.