chmod 4755: setuid: a program that runs as its owner

What chmod 4755 means

In 4755 the first digit is the special-bits digit (4 = setuid, 2 = setgid, 1 = sticky; the values add up to combine them), so 4 sets setuid. The next three digits are owner, group and others: the owner gets read, write and execute, the group gets read and execute, and others get read and execute.

ls -l shows -rwsr-xr-x. The s in the owner's execute position is setuid plus execute; a capital S means setuid is set but execute is not, which does nothing useful.

Where setuid is used

passwd is the textbook case. Changing your password means writing /etc/shadow, which only root may modify, so /usr/bin/passwd is owned by root with mode 4755 and runs with root's effective user ID while it checks who you are and only lets you change your own entry. su, mount and sudo are setuid root for the same reason, though the exact mode differs between distributions.

These programs are written with their elevated position in mind: they drop privileges early, sanitise their environment and validate every input. An ordinary program is not.

Security warning

A setuid root binary with a bug is a local privilege escalation. Never set 4755 on your own programs to get around a permission problem; use sudo rules, Linux capabilities with setcap, or a service running as the right user instead. Never put it on scripts at all. Linux ignores setuid on interpreted scripts that start with a shebang, precisely because the gap between the kernel starting the interpreter and the interpreter opening the script was a classic attack, so the bit gives a false sense of having done something.

Audit regularly with find / -perm -4000 -type f -ls 2>/dev/null, which lists every setuid file, and compare it with what your distribution ships. An unexpected entry, especially in a home or /tmp directory, is a sign of compromise. Filesystems that should never hold such programs can be mounted with the nosuid option, which makes the kernel ignore the bit.

Removing it

chmod u-s file clears setuid and keeps everything else; chmod 755 file does the same for a regular file. Note that writing to a setuid file as a non-root user makes the kernel clear the bit automatically, and chown clears it too, so re-check the mode after replacing such a binary.