UNIX Permissions

UNIX (and POSIX) file permissions control access to files and directories at the filesystem level. Every object has three permission sets — user (owner), group, and other — each of which can grant read (r, 4), write (w, 2), and execute (x, 1). Beyond these, three special bits modify behavior: SUID, SGID, and the sticky bit. ¹

Symbolic vs. numeric permissions

Numeric (absolute) permissions exactly specify all bits: chmod 755 file sets rwxr-xr-x.

Symbolic permissions are more flexible — they allow targeted changes without specifying unaffected sets:

chmod u+x file        # grant execute to user
chmod g-w,o= file     # remove write from group, clear all other permissions
chmod ug=rw,o=r file  # user+group read/write, other read-only

The operator determines the action: + (grant), - (remove), = (set exactly). Sets are separated by commas; identical sets can be combined (ug).

Permission table

Permission	Symbolic	Numeric
Read	r	4
Write	w	2
Execute	x	1
SUID	s/S	4 (prefix digit)
SGID	s/S	2 (prefix digit)
Sticky bit	t	1 (prefix digit)

The SUID/SGID bits use s when the owner/group also has execute permission, S when they don’t. The sticky bit is applied to the “other” set when set symbolically; numerically, all three special bits go in the prefix digit (e.g., chmod 4755 = SUID + rwxr-xr-x).

SUID

Set User ID: The process runs with the file owner’s effective UID, not the invoker’s. If a SUID-root binary has a vulnerability or shell escape, it yields root. This is why SUID binaries are a primary reconnaissance and privesc target — find them with:

find / -perm -4000 -type f 2>/dev/null

See suid-shell-executable for a concrete exploitation technique.

SGID

Set Group ID:

• On files: Process runs with the file’s group. Rarely used in practice.
• On directories: New files inherit the directory’s group ownership. This is the common use case — shared project directories where all team members need consistent group access regardless of who creates the file.

Sticky bit

Only meaningful on directories. A file in a sticky-bit directory can only be deleted or renamed by its owner (or root), even if other users have write access to the directory. /tmp is the canonical example — everyone can create files, but only the owner can remove them.

Write permissions on directories

If a user has write access to a directory, they can modify, rename, or delete any file in it — even files they don’t own and can’t read. Write access on a directory is effectively control over its entire contents’ metadata. This is a critical privilege escalation vector when combined with misconfigured application directories.

Sources

• chmod(1) — Linux manual page (GNU coreutils 9.11)
• Linux permissions: An introduction to chmod
• Linux permissions: SUID, SGID, and sticky bit

Related: suid-shell-executable, linux-reconnaissance-commands, bash-scripting, linux-file-capabilities, etc-passwd-weak-permissions, etc-shadow-weak-permissions, sudo-nopasswd-recon

Footnotes

1. chmod(1) — Linux manual page (GNU coreutils 9.11) ↩