chmod `4755` — what does it mean?

The leading 4 is the setuid bit. When a user executes a setuid binary, the process takes the file owner's user ID as its effective UID. That is how ordinary users can change their own password: /usr/bin/passwd is owned by root and is 4755, so it can write to /etc/shadow. It is also one of the oldest privilege-escalation surfaces in Unix, because a bug in a setuid-root program is a bug running as root. In ls -l the owner's x becomes s: rwsr-xr-x.

In plain English

4755

rwsr-xr-x

755 permissions plus setuid: anyone can run the program, and while it runs it has the privileges of the file's owner (usually root) instead of the caller's.

Symbolic equivalent: chmod u=rwxs,g=rx,o=rx /usr/local/bin/mytool

Open 4755 in the chmod calculator

What each digit in 4755 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The leading 4 is the special-permission digit: setuid (4). The other three digits are owner, group and others.

Class	Digit	Sum	r w x	ls -l
Owner (u)	7	4 + 2 + 1	rwx	rws
Group (g)	5	4 + 0 + 1	r-x	r-x
Others (o)	5	4 + 0 + 1	r-x	r-x

Owner: can read the contents, modify the contents and run it as a program.
Group: can read the contents and run it as a program; no write.
Others: can read the contents and run it as a program; no write.
setuid: the owner's x shows as s; the program runs with the file owner's user ID.

When to use chmod 4755

System programs that must do one privileged thing for unprivileged users: passwd, su, sudo, mount, newgrp, chsh.
Very small, carefully audited helpers that perform a single privileged action. For most new tools, a sudo rule, a systemd service or Linux capabilities (setcap) is the better design.
You will mostly meet 4755 when auditing, not when writing: knowing which binaries on a host are setuid is a standard security check.

Security risks and gotchas

Any bug runs as the owner

A setuid-root binary that can be tricked into running a shell, writing an arbitrary file or loading a library is a full root compromise. Never set setuid on interpreters, editors, shells or anything that runs user-supplied commands.

Linux ignores setuid on scripts

The Linux kernel does not honour setuid on interpreted scripts (#!/bin/bash and similar), because of race conditions in how scripts are launched. chmod 4755 on a script sets the bit, shows rws in ls, and does nothing. Use sudo with a narrow rule instead.

Writes and chown clear it

On Linux, when a non-root user writes to a setuid file, or when the file's owner is changed with chown, the kernel clears the setuid bit. Always chown first and chmod 4755 last. Filesystems mounted with nosuid (common for /tmp, /home and removable media) ignore the bit entirely.

sudo chown root:root /usr/local/bin/mytool
sudo chmod 4755 /usr/local/bin/mytool

Capital S means it is broken

If the owner's execute bit is missing (for example chmod 4644), ls -l shows rwS. The bit is set but the file cannot be executed by its owner's class, which is almost always a mistake.

Commands

Set setuid with the usual 755

sudo chmod 4755 /usr/local/bin/mytool

Equivalent to chmod u=rwxs,g=rx,o=rx, or chmod u+s on a file that is already 755.

Remove setuid

sudo chmod u-s /usr/local/bin/mytool

chmod 0755 also clears it on a regular file.

Audit setuid binaries on a host

find / -xdev -perm -4000 -type f -exec ls -l {} + 2>/dev/null

Compare the list with what your distribution ships. An unexpected setuid file, especially in /tmp or a home directory, is a red flag.

Prefer capabilities when one privilege is enough

sudo setcap cap_net_bind_service=+ep /usr/local/bin/myserver

Lets a program bind to ports below 1024 without being setuid root. Modern ping uses capabilities the same way.

How to check for 4755

# Symbolic view
ls -l /usr/local/bin/mytool
-rwsr-xr-x  1 root root  59976 Oct 16 09:12 /usr/local/bin/mytool

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' /usr/local/bin/mytool
4755 -rwsr-xr-x /usr/local/bin/mytool

# Octal view (macOS / BSD)
stat -f '%Mp%Lp %Sp %N' /usr/local/bin/mytool

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

755rwxr-xr-x

Owner full access, everyone else read and execute

1777rwxrwxrwt

Sticky bit: world-writable, delete only your own files

711rwx--x--x

Owner full access, others execute or traverse only

775rwxrwxr-x

Owner and group full access, others read and execute

Try variations of 4755 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

What does the 4 in chmod 4755 mean?▾

It is the special-permission digit. 4 is setuid, 2 is setgid and 1 is the sticky bit, and they add up like the other digits (6755 sets setuid and setgid). The remaining 755 are the usual owner, group and other permissions.

How do I know if a file is setuid?▾

ls -l shows an s in the owner's execute position (-rwsr-xr-x). stat -c %a prints the four-digit mode, e.g. 4755. find / -perm -4000 lists every setuid file.

Does setuid work on shell scripts?▾

Not on Linux. The kernel ignores the setuid bit on interpreted scripts. Use a sudo rule that allows the specific script, or write a small compiled wrapper only if you fully understand the security implications.

What is the difference between setuid and setgid?▾

setuid (4xxx) runs a program with the file owner's user ID. setgid (2xxx) runs it with the file's group ID; on a directory, setgid instead makes new files inherit the directory's group, which is its most common use (2775).

chmod 4755 — what does it mean?