Special Bits: umask, SUID, SGID, and Sticky Bit

Beyond the standard rwx bits, Linux has three special permission bits. The SUID (Set User ID) bit on an executable causes it to run with the permissions of the file owner rather than the user who launches it — this is how `passwd` can modify `/etc/shadow` as root. The SGID (Set Group ID) bit on a directory causes new files created within it to inherit the directory group rather than the creator group, which is useful for shared project directories. The sticky bit, when set on a directory, prevents users from deleting or renaming files they do not own, even if they have write permission on the directory. This is used on `/tmp` so all users can create temporary files but cannot delete each other others. You will see the sticky bit displayed as a `t` at the end of the permission string. The `umask` command controls the default permissions assigned to newly created files and directories. It works as a bitmask that subtracts permissions from the maximum defaults (666 for files, 777 for directories). The most common umask values are 022 (resulting in 644/755) for public servers and 027 (resulting in 640/750) for more restrictive environments.

Example

# View current umask
umask
# 0022

# Set a more restrictive umask (new files: 640, dirs: 750)
umask 027

# Demonstrate umask effect
umask 022
touch testfile.txt && ls -l testfile.txt
# -rw-r--r-- (666 - 022 = 644)
mkdir testdir && ls -ld testdir
# drwxr-xr-x (777 - 022 = 755)

# Set umask permanently in ~/.bashrc or /etc/profile
echo "umask 027" >> ~/.bashrc

# ---- SUID bit ----
# Numeric: 4 prefix (e.g., 4755)
sudo chmod u+s /usr/bin/program    # Symbolic
sudo chmod 4755 /usr/bin/program   # Octal

# Find SUID files (security audit)
find / -perm -4000 -type f 2>/dev/null

# ---- SGID bit ----
# Numeric: 2 prefix (e.g., 2775)
sudo chmod g+s /shared/project/    # Symbolic
sudo chmod 2775 /shared/project/   # Octal

# New files in SGID dir inherit the directory group
# useful for collaborative directories

# ---- Sticky bit ----
# Numeric: 1 prefix (e.g., 1777)
sudo chmod +t /shared/uploads/     # Symbolic
sudo chmod 1777 /tmp/              # Octal

ls -ld /tmp/
# drwxrwxrwt 20 root root 4096 Apr 10 09:00 /tmp/
# Note the 't' at end — sticky bit set

# Find sticky directories
find / -type d -perm -1000 2>/dev/null

HTML

Full Editor

Related Resources

Linux / Bash Reference

Complete tag & property list

Linux / Bash How-To Guides

Step-by-step practical guides

Linux / Bash Exercises

Practice what you've learned