chmod Special Bits and Directories: setuid, setgid, sticky and x on a Directory
The fourth digit
A four-digit mode puts the special bits first: 4 setuid, 2 setgid, 1 sticky, added together. The calculator keeps them (4755 is rwsr-xr-x) where an octal of only three digits cannot express them. chmod 755 on a file that was 4755 clears setuid, so a SUID binary stops working after a careless chmod.
| Bit | On a file | On a directory |
|---|---|---|
| setuid (4000) | Runs with the owner's privileges | Ignored on Linux |
| setgid (2000) | Runs with the group's privileges | New entries inherit the directory's group |
| sticky (1000) | Historically ignored | Only the owner of an entry (or the directory's owner) may delete or rename it |
/tmp is 1777 (rwxrwxrwt): everyone can write, but only owners can delete their own files.
Reading s, S, t, T
In the symbolic form the special bit takes the place of x in its class. Lowercase means execute is also set; uppercase means it is not. rwsr-xr-x is setuid with execute; rwSr--r-- is setuid without owner execute, a combination that has no effect and usually signals a mistake. The calculator notes it.
x on a directory
Execute on a directory means "may traverse": permission to reach entries inside by name. Read lets you list names. So:
| Mode | Effect |
|---|---|
755 | Everyone can list and enter |
711 | Others can enter and open a file whose name they know, but cannot list |
644 | Others can list names but cannot enter, so they cannot open anything |
How the symbolic calculator follows GNU chmod
Xadds execute only for directories, or files that already have an execute bit for someone.- With no
u/g/o/a, bits in your umask are left alone. =on a directory keeps setuid and setgid unless the expression mentionss. On a file it clears them.g=ucopies the owner's permissions to the group.