chmod 2775: a shared project directory where new files keep the group

What chmod 2775 means

In 2775 the first digit is the special-bits digit (4 = setuid, 2 = setgid, 1 = sticky; the values add up to combine them), so 2 sets setgid. The next three digits are owner, group and others: the owner gets read, write and execute, the group gets read, write and execute, and others get read and execute.

ls -l shows -rwxrwsr-x. The s in the group's execute position is setgid combined with group execute; a capital S would mean setgid without execute, which on a directory leaves group members unable to enter it.

Why shared directories need setgid

Without setgid, a new file takes the primary group of whoever creates it. In a team directory that means files keep landing in personal groups, and colleagues lose write access even though the directory itself is 775. With setgid on the directory, Linux assigns new entries the directory's group, and new subdirectories inherit the setgid bit too, so the arrangement propagates down the tree on its own.

A typical setup is groupadd web, chgrp -R web /srv/site, find /srv/site -type d -exec chmod 2775 {} + and find /srv/site -type f -exec chmod 664 {} +.

The umask still matters

setgid fixes the group, not the mode. A user with the common 022 umask still creates files as 644, so the group can read but not edit them. Set umask 002 for the people and services that write into the tree, for example in the service unit with UMask=0002, or use default ACLs if you cannot control every writer.

Pitfalls

GNU chmod deliberately preserves setgid on directories when you pass a three-digit mode, so chmod 755 dir leaves the s in place. To clear it you need chmod g-s dir or an explicit leading zero such as chmod 00755 dir. Files moved into the directory with mv keep their original group, because only newly created entries inherit it, so run chgrp after moving content in. On a regular file, setgid means something different: the program runs with the file's group, which is rarely what you want on data.