setuidsetgid

Setuid and setgid are special permission bits in Unix-like operating systems. They alter the privileges with which a program runs by changing its effective user ID (UID) or effective group ID (GID) when the program starts.

When the setuid bit is set on an executable file, the process runs with the file owner's user ID as its effective UID, regardless of who launched it. If the owner is root, the program executes with root privileges. This mechanism enables utilities that require higher privileges, such as password-changing tools, but it also raises security risks.

The setgid bit has a similar effect for groups: an executable with setgid runs with the file's group ID as its effective GID. When set on a directory, the setgid bit ensures that new files and subdirectories created within inherit the directory's group ID, which aids collaborative work. It does not grant additional privileges in itself when used on regular programs.

On most Unix-like systems, setuid and setgid bits on scripts are ignored by the kernel or treated as no-ops, because allowing scripts to elevate privileges is a security hazard. Executable binaries are the typical carriers of these bits.

Managing these bits involves chmod and a careful ownership model. To enable setuid, the file must be owned by the target user, commonly root, and you would use commands such as chmod u+s file or chmod 4755 file. To enable setgid on a directory, use chmod g+s dir or chmod 2755 dir; verify with ls -l and ls -ld.

Security considerations: grant setuid/setgid sparingly and only to trusted binaries; keep ownership and permissions under audit; disable or remove the bits when no longer needed; use additional controls such as SELinux or AppArmor to constrain their behavior.