chmod 4755

rwsr-xr-xUse with care

755 plus setuid: the program runs with its owner's privileges.

4755 is 755 with the setuid bit. When anyone runs the file, it executes with the privileges of the file's owner rather than the user who started it. In ls -l the owner's x becomes an s: rwsr-xr-x.

That's how passwd (owned by root) can update /etc/shadow for an ordinary user, and how sudo works. It's also why setuid-root binaries are a favourite target for privilege escalation.

Permission by permission

Who	Read	Write	Execute	Digit	Means
owner	✓	✓	✓	7	read, write and execute
group	✓	—	✓	5	read and execute
others	✓	—	✓	5	read and execute

In ls -l: -rwsr-xr-x for a file, drwsr-xr-x for a directory.
Symbolic form: u=rwx,g=rx,o=rx,u+s
New directories get this mode when the umask is 022.

Use it for

System programs that must act with elevated rights on a user's behalf, such as passwd and sudo.

Avoid it for

Your own scripts: Linux ignores setuid on interpreted scripts, and setuid binaries you write are a security liability.
Prefer narrowly scoped alternatives: sudo rules or Linux capabilities (setcap).

Commands

chmod 4755 path

set this mode on a file or directory

chmod u=rwx,g=rx,o=rx,u+s path

the same, written symbolically

find path -type d -exec chmod 4755 {} +

apply it to every directory in a tree, leaving the files alone

stat -c '%a %A %n' path

check the current mode on Linux (macOS: stat -f '%Lp %Sp %N' path)

Try variations

Mode — octal or ls -l form

4755

-rwsr-xr-x

Who	read	write	execute	Digit
owner				7
group				5
others				5

setuid— run as the file's ownersetgid— run as / inherit the groupsticky— only owners delete entries

The owner can read, write and execute; the group can read and execute; everyone else can read and execute. Special: runs as the file's owner (setuid).

chmod 4755 file

chmod u=rwx,g=rx,o=rx,u+s file

Read the full guide to chmod 4755 →

Frequently asked questions

What does the s in rwsr-xr-x mean?

The setuid bit is set and the owner can execute. A capital S means setuid is set but the owner's execute bit isn't — usually a mistake.

How do I find setuid files on a system?

Run find / -perm -4000 -type f 2>/dev/null. Review the list: unexpected entries are a classic sign of compromise.