setid

Setid is a shorthand term used to refer to the set-id permission bits in Unix-like file systems, specifically the setuid and setgid bits. These special bits modify how executables or directories behave when accessed.

Setuid on an executable file causes the program to run with the privileges of the file’s owner during execution, regardless of the user who launched it. The owner is often root, which creates potential for privilege escalation if the program is flawed. Setuid-enabled programs are used for tasks that require higher privileges than the invoking user, such as password changing or system management utilities, but they carry security risks if not carefully controlled.

Setgid on an executable file makes the program run with the privileges of the file’s group. On directories, the setgid bit causes newly created files and subdirectories to inherit the directory’s group ownership, helping to maintain consistent group permissions for collaborative work.

Setting and clearing these bits is done with chmod. For example, chmod u+s filename enables setuid on the file, and chmod g+s directory enables setgid on the directory. The numeric modes are 4000 for setuid, 2000 for setgid, and 6000 for both bits set.

Security considerations are central to setid usage. Setuid and setgid can introduce privilege-escalation risks, so many systems restrict setuid programs, audit them carefully, and restrict or remove these bits when not needed. Modern practices also favor alternatives such as capabilities or the use of sudo for controlled privilege elevation, and many Unix-like systems ignore setuid on scripts for safety.