The first digit of a four-digit chmod mode sets special bits: 4 is setuid, 2 is setgid and 1 is the sticky bit. Setuid on a root owned program lets anyone run it with root's identity, so every such file is a standing risk and worth listing, justifying and keeping short.
How the digits add up
The GNU chmod manual says a numeric mode is one to four octal digits, built by adding 4, 2 and 1. The first digit selects the set user ID (4), set group ID (2) and restricted deletion or sticky (1) attributes. The next three digits are permissions for the owner, the file's group, and everyone else, each using read 4, write 2 and execute 1. Omitted digits are leading zeros.
So chmod 4755 tool means setuid plus rwxr-xr-x, and chmod 1777 dir means sticky plus full access for all.
What each special bit does
Setuid (4). A program with this bit runs with the file owner's user ID, not the caller's. On a root owned file that means root. The passwd command is the textbook case, because ordinary users must update a protected file.
Setgid (2). On a program, it runs with the file's group. On a directory, the inode manual says new files created there get the group of the directory, and new subdirectories inherit the setgid bit. That is handy for shared project folders.
Sticky (1). On a directory, the chmod manual says it stops unprivileged users from removing or renaming a file unless they own the file or the directory. It is commonly found on world-writable directories like /tmp.
Two behaviors that surprise people
chmodclears the setgid bit on a regular file if its group does not match your effective group or one of your supplementary groups, unless you have privilege. The manual also says other restrictions may cause these bits to be ignored, so check the result.- For directories, chmod keeps setuid and setgid bits unless told otherwise. Clearing them with a numeric mode needs an extra leading zero such as
00755, or a symbolic form likeg-s.
Find the setuid and setgid files
List them across local file systems:
find / -xdev -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null
Save the output as a baseline. Next time, compare. A new setuid binary in /tmp, a home directory or a web root is a red flag. Review each known entry once and ask whether it is needed on a server at all.
Reduce the list
- Remove the bit from tools you do not use with
chmod u-s file, after checking the package manager does not restore it on update. - Mount data partitions with
nosuidso the bit has no effect there. - Run services with NoNewPrivileges and related directives so setuid tools they spawn cannot raise privilege.
- Keep the baseline in version control and diff it on a schedule.
Safeguard offers asset discovery and compliance evidence automation, which can hold the proof that these reviews happened, and a free scan at gold.safeguard.sh/scan.
Quick check
What does chmod 2775 on a directory do?
It gives the owner and group full access, others read and search, and sets the setgid bit so new files inherit the directory's group.
Why is setuid root risky?
Any flaw in that program runs with root's authority, so each setuid root file widens the attack surface.
Sources
Last reviewed: 19 October 2026.
