Another special permission is called SGID or Set Group ID. 1
It’s very similar to SUID, 2
the only difference being that the executable file having SGID configured, will run with the same 3
permissions as of the group owner. In practice we’ll explicitly set SGID, mainly to directories. 4
If you set up SGID on directories, all files and subdirectories created inside that directory will 5
be owned by the same group owner of the directory where SGID was configured. 6
This is very useful in creating shared directories, which are directories that are writable at the 7
group level. 8
I'm going straight to the point with a practical example. 9
I'm creating a new group called Programmers, and two new users that will belong to this group as their 10
secondary group. 11
They will also belong to other secondary groups. 12
I'm becoming root, sudo su groupadd programmers 13
And useradd -s the shell /bin/bash pr1 the first programmer and the second programmer 14
pr2 15
I'm adding the new users to the programmer's group 16
I've just created: usermod -aG programmers and the users pr1 and pr2 17
I'm creating a new director for the group. 18
I want the directory to be shared to the group, but no other users to be able to work on it. 19
So mkdir/programming 20
This will be the shared directory. The owner of the directory will be one of the programmers and 21
the group owner, the programmers group. 22
So chmod pr1: programmers 23
the group and the directory 24
OK, I'm also setting the desired permissions on the directory, I want only the owner and the group 25
to have access to it: chmod. 26
770 and the directory 27
Now, it's perfect! I'm becoming one of the programmers by executing su and the username 28
su pr1 29
I'm pr1 and I'm moving to the shared directory and creating a file. 30
And we notice that the group owner of the file is the primary group of the creator and the other users 31
in the programmer's group will not be able to change the file to work on it. 32
Of course, I could give the permission to the other category, but this is a security issue and I don't 33
want it. 34
So this is not good. 35
Now, I'll set the SGID bit on the directory. 36
To set SGID I'll prepend 2 to the existing permissions. I'm exiting tobe root and I'm setting the 37
permissions chmod 2 and the existing permissions. 38
Or if you want to use the symbolic mode, use g+s 39
To verify if SGID bit is applied or not use the ls or stat commands. 40
Simply look at the position of the execution, permission for the group; the letter s at that position 41
means that thethe SGID bit is set. If you see a capital S instead of a small s, it indicates 42
that there is no executable permission applied to that directory. 43
However, this is not common at all. 44
After setting SGID I’m becoming a user of the group, moving to /programming directory and creating a file 45
and a directory. 46
So su pr2 for example, the other user. And I'm moving to that directory. 47
And touch source2.cpp 48
And mkdir golang_python 49
See the difference! 50
The new files and directories have the group owner, the group of the parent directory that SGID set 51
instead of the primary group of the creator. 52
On the group position 53
have a look at the differences between these two lines. 54
This is, in fact, what SGID set does. Now 55
anyone in that group and only in that group can work with the file. 56
Maybe it seems like a small detail, but it's really important if you want to have shared directories 57
at the group level.