What it means
chmod 2775 is chmod 775 plus the setgid bit. The owner and group get full access, others can read and enter. Because setgid is set on a directory, every file or subdirectory created inside gets the directory's group, not the creator's primary group. In ls -l it shows as drwxrwsr-x: the s in the group's execute position is the setgid bit.
| Who | Digit | Read | Write | Execute | Symbolic |
|---|---|---|---|---|---|
| Special | 2 | setgid (s) |
|||
| Owner (u) | 7 | yes | yes | yes | rwx |
| Group (g) | 7 | yes | yes | yes | rws |
| Others (o) | 5 | yes | no | yes | r-x |
In the leading digit, 4 is setuid, 2 is setgid and 1 is sticky. The symbolic equivalent:
chmod u=rwx,g=rwxs,o=rx /srv/site
On a directory
Without setgid, a file you create belongs to your primary group. In a shared directory that's a problem: Alice creates index.html as alice:alice, and Bob (in the web group) can't edit it. With setgid on the directory, the file is created as alice:web, so the whole group keeps access. New subdirectories also inherit the setgid bit, so the rule carries down the tree.
ls -ld /srv/site
# drwxrwsr-x 4 root web 4096 Oct 5 10:00 /srv/site
A capital S (rwxrwSr-x) means setgid is set but group execute is not, which is almost always a mistake on a directory.
On a file
On an executable file, setgid makes the program run with the file's group instead of the caller's. A few system tools use it to reach group-owned data. It's rarely what you want for your own files, so set 2775 on directories only.
Setting up a shared folder
sudo groupadd web
sudo usermod -aG web alice
sudo usermod -aG web bob
sudo chown -R root:web /srv/site
sudo find /srv/site -type d -exec chmod 2775 {} +
sudo find /srv/site -type f -exec chmod 664 {} +
Then make sure new files are group-writable, which depends on each user's umask. Set umask 002 in their shell profile (or UMask=0002 for a systemd service). Without it, files come out as 644 and the group gets read only. Users must log in again for a new group membership to apply.
Existing files don't change
Setgid only affects files created after it's set. Files copied with cp -p, extracted with tar as root (which restores the stored owner and group), or moved with mv from elsewhere keep their old group. Fix them with chgrp -R web /srv/site.
Clearing it
With GNU chmod, a numeric mode like chmod 755 dir does not remove setgid from a directory. Clear it explicitly:
chmod g-s /srv/site
Recursive pitfalls
chmod -R 2775 sets setgid and execute on every file too. Executable, setgid data files aren't what you want; use the find commands above to treat directories and files separately.
Variations
| Mode | Use |
|---|---|
| 2770 | Shared group directory, others shut out |
| 2775 | Shared group directory, others can read |
| 3775 | Same, plus sticky: members can't delete each other's files |
Related modes
- chmod 775: the same, without group inheritance.
- chmod 664: the matching file mode.
- chmod 1777: the sticky bit.
- chmod 4755: the setuid bit.
Check the special bits in the chmod calculator.