Setgid

The set-group-ID bit, commonly called setgid or SGID, has two important uses. On an executable regular file, it can change the effective group ID of the new process. On a directory, it makes newly created entries inherit the directory's group, which is especially useful for collaborative trees.

Setgid on Executable Files

A long listing can show setgid in the group execute position:

$ ls -l /path/to/program
-rwxr-sr-x 1 root operators 24576 Jan 10 09:30 /path/to/program

Lowercase s means that both setgid and group execute are set. Uppercase S means setgid is set but group execute is absent.

When the kernel honors this bit during execution, the process receives an effective group ID based on the executable's group owner. The behavior can be suppressed by controls such as a nosuid mount, and it must not be treated as a universal guarantee across every file type or environment.

Setgid on Directories

Setgid on a directory has a different purpose. New files and subdirectories normally inherit the directory's group instead of the creator's default group. New subdirectories also inherit the setgid bit on Linux, helping a shared project tree keep a consistent group.

Setgid does not itself grant group write access. The directory mode, process umask, requested creation mode, default ACLs, and other controls still determine access.

$ sudo chgrp developers /srv/project
$ sudo chmod g+s /srv/project
$ ls -ld /srv/project
drwxr-sr-x 2 root developers 4096 Jan 10 09:30 /srv/project

Setting and Removing Setgid

Set the bit symbolically with:

$ sudo chmod g+s myfile

Set it together with ordinary mode bits using a leading octal 2:

$ sudo chmod 2755 myfile

Remove only the special bit with chmod g-s myfile.

Using Shared Directories Safely

For a collaborative directory, combine the intended group owner, setgid, and narrowly chosen access bits. Test creation as representative users and inspect results with ls -ld. Avoid making a tree world-writable merely to solve group-sharing problems; a dedicated group, appropriate umask or default ACL, and setgid directory usually provide clearer control.

Summary

You can now distinguish the executable and directory meanings of setgid.

1. Recognize setgid in the group execute position.
2. Relate executable setgid to the effective group ID.
3. Use directory setgid to preserve group ownership in shared trees.
4. Set or remove the bit without confusing it with ordinary write access.