setgid are needed for tasks that require higher privileges than those which common users have, such as changing their login password. Some of the tasks that require elevated privileges may not immediately be obvious, though — such as the
ping command, which must send and listen for control packets on a network interface.
setgid flags have an entirely different meaning depending whether they are set on a file or a directory.
setgid attributes are set on an executable file, then any users able to execute the file will automatically execute the file with the privileges of the file's owner (commonly root) and/or the file's group, depending upon the flags set. This allows the system designer to permit trusted programs to be run which a user would otherwise not be allowed to execute. These may not always be obvious. For example, the ping command may need access to networking privileges that a normal user cannot access; therefore it may be given the setuid flag to ensure that a user who needs to ping another system can do so, even if their own account does not have the required privilege for sending packets.
For security purposes, the invoking user is usually prohibited by the system from altering the new process in any way, such as by using
LD_LIBRARY_PATH or sending signals to it, to exploit the raised privilege, although signals from the terminal will still be accepted.
setgid bits are normally set with the command
chmod by setting the high-order octal digit to 4 for
setuid or 2 for
chmod 6711 file" will set both the
setgid bits (4+2=6), making the file read/write/executable for the owner (7), and executable by the group (first 1) and others (second 1). When a user other than the owner executes the file, the process will run with user and group permissions set upon it by its owner. For example, if the file is owned by user
root and group
wheel, it will run as
root:wheel no matter who executes the file.