How to Configure SUID, SGID, and Sticky Bit Special Permissions in Linux Terminal

Standard Linux file permissions rely on read (r), write (w), and execute (x) modes assigned across owner, group, and other scopes. While this standard model suffices for basic access control, multi-user systems, collaborative project directories, and system binaries require more sophisticated execution privileges. Linux solves this through three special permission bits: Set Owner User ID (SUID), Set Group ID (SGID), and the Sticky Bit. Managing these flags via the terminal allows administrators to configure shared team directories and understand critical system security boundaries.

Understanding Special Permission Bits and Octal Values

In the Linux permission architecture, special permissions represent an additional four-digit octal prefix preceding the standard three-digit permission mode:

• SUID (Set User ID – Octal 4000): When placed on an executable binary, any user running the program executes it with the privileges of the file’s owner rather than their own identity. (Classic example: /usr/bin/passwd, which allows normal users to update /etc/shadow owned by root). Represented symbolically as s in the user execute position.
• SGID (Set Group ID – Octal 2000): On an executable binary, the process runs with the privileges of the file’s group. On a directory, any new file or subfolder created inside automatically inherits the parent directory’s group ownership rather than the primary group of the creating user. Represented symbolically as s in the group execute position.
• Sticky Bit (Octal 1000): When applied to a shared directory, users can only delete or rename files that they personally own, even if the directory grants write permissions to everyone. (Classic example: the /tmp directory). Represented symbolically as t in the other execute position.

Configuring the Sticky Bit on Shared Directories

To establish a shared drop folder where multiple team members can write files without allowing users to delete each other’s work:

1. Open your Linux terminal session.
2. Create the shared folder:

   sudo mkdir /var/shared_drop

3. Grant read, write, and execute permissions to all users while adding the Sticky Bit (octal 1777):

   sudo chmod 1777 /var/shared_drop

4. Alternatively, apply the Sticky Bit using symbolic notation:

   sudo chmod +t /var/shared_drop

5. Verify the permission string using ls -ld:

   ls -ld /var/shared_drop
   drwxrwxrwt 2 root root 4096 Oct 28 05:45 /var/shared_drop

6. The lowercase t at the end of the mode string confirms that the Sticky Bit is active alongside standard execution permissions. (A capital T indicates the sticky bit is active, but the underlying execute bit is absent).

Configuring SGID for Collaborative Group Directories

In shared departmental workspaces (e.g., for developers or finance teams), SGID ensures that all files created by any member automatically belong to the group, eliminating permission mismatch errors:

1. Create the group directory and assign group ownership:

   sudo mkdir /srv/project_docs
   sudo chgrp developers /srv/project_docs

2. Apply read, write, and execute permissions with SGID enabled (octal 2775):

   sudo chmod 2775 /srv/project_docs

3. Or apply via symbolic notation:

   sudo chmod g+s /srv/project_docs

4. Verify the mode string:

   ls -ld /srv/project_docs
   drwxrwsr-x 2 root developers 4096 Oct 28 05:45 /srv/project_docs

5. The s in the group execute position guarantees that all files created inside inherit the developers group automatically.

Managing SUID and Security Auditing

Because SUID allows arbitrary binaries to execute with root privileges, improper usage poses substantial privilege escalation risks:

1. To assign SUID to an executable using octal mode (e.g., mode 4755):

   sudo chmod 4755 /usr/local/bin/custom_tool

2. Or symbolically:

   sudo chmod u+s /usr/local/bin/custom_tool

3. To audit your entire Linux system for all SUID binaries to ensure no unauthorized backdoors exist:

   sudo find / -perm -4000 -type f -exec ls -ld {} + 2>/dev/null

4. To remove an unsafe SUID bit:

   sudo chmod u-s /path/to/binary

Removing Special Permissions

To strip special permission bits and restore standard file modes:

• Remove Sticky Bit: sudo chmod -t /path/to/directory
• Remove SGID: sudo chmod g-s /path/to/directory
• Remove SUID: sudo chmod u-s /path/to/binary
• Alternatively, reset using standard three-digit octal modes (e.g., chmod 0755 ...).