The set-group-ID bit, commonly called setgid or SGID, has two important uses. On an executable regular file, it can change the effective group ID of the new process. On a directory, it makes newly created entries inherit the directory's group, which is especially useful for collaborative trees.
Permissions · Lesson 6
Setgid
Learn how set-group-ID affects executable credentials and group inheritance in shared directories.
Setgid on Executable Files
A long listing can show setgid in the group execute position:
$ ls -l /path/to/program
-rwxr-sr-x 1 root operators 24576 Jan 10 09:30 /path/to/program
Lowercase s means that both setgid and group execute are set. Uppercase S means setgid is set but group execute is absent.
When the kernel honors this bit during execution, the process receives an effective group ID based on the executable's group owner. The behavior can be suppressed by controls such as a nosuid mount, and it must not be treated as a universal guarantee across every file type or environment.
When setgid on an executable is honored, which credential comes from the executable's group owner?
Setgid on Directories
Setgid on a directory has a different purpose. New files and subdirectories normally inherit the directory's group instead of the creator's default group. New subdirectories also inherit the setgid bit on Linux, helping a shared project tree keep a consistent group.
Setgid does not itself grant group write access. The directory mode, process umask, requested creation mode, default ACLs, and other controls still determine access.
$ sudo chgrp developers /srv/project
$ sudo chmod g+s /srv/project
$ ls -ld /srv/project
drwxr-sr-x 2 root developers 4096 Jan 10 09:30 /srv/project
What does setgid on /srv/project normally make a newly created file inherit?
Setting and Removing Setgid
Set the bit symbolically with:
$ sudo chmod g+s myfile
Set it together with ordinary mode bits using a leading octal 2:
$ sudo chmod 2755 myfile
Remove only the special bit with chmod g-s myfile.
Which value does setgid contribute to the leading special-bits octal digit?
Using Shared Directories Safely
For a collaborative directory, combine the intended group owner, setgid, and narrowly chosen access bits. Test creation as representative users and inspect results with ls -ld. Avoid making a tree world-writable merely to solve group-sharing problems; a dedicated group, appropriate umask or default ACL, and setgid directory usually provide clearer control.
Does setting setgid alone give group members permission to create files in a directory?
Lesson complete
You finished Setgid
You can now distinguish the executable and directory meanings of setgid.
Recognize setgid in the group execute position.
Relate executable setgid to the effective group ID.
Use directory setgid to preserve group ownership in shared trees.
Set or remove the bit without confusing it with ordinary write access.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account