Combining Special Bits: The Four-Digit Octal

The Full Permission Octal

When using octal mode with special bits, you use a 4-digit number: a leading special-bits digit followed by the usual three digits for User, Group, and Others. The special digit is the sum of SUID (4), SGID (2), and Sticky (1) — so 4755 sets SUID on top of rwxr-xr-x (common for privileged binaries), 2775 sets SGID on top of rwxrwxr-x (common for shared directories), and 1777 sets the sticky bit on top of full rwxrwxrwx (common for shared temp directories). When you use a 3-digit octal (like chmod 755), the leading special digit is implicitly 0. Combining multiple special bits — 6755 for SUID+SGID, or 7777 for all three — is legal but rare, and almost always worth double-checking rather than treating as a normal configuration.

Uppercase letters: the "ineffective" indicator:

As with the sticky bit and SUID individually, when a special bit is set but the corresponding execute bit is missing for that category, it renders as an uppercase letter instead of lowercase — capital S for SUID or SGID without execute, capital T for sticky without execute. This holds regardless of which special bits are combined, and it's always a signal to investigate: the bit is present in the permission data but literally has no effect until execute is also granted for that category — usually a sign of misconfiguration.

Key Point: In production, you'll rarely need to combine multiple special bits. The most common patterns are: 4755 for SUID binaries, 2775 for SGID shared directories, and 1777 for sticky shared temp directories. If you find yourself using 6xxx or 7xxx, double-check whether you actually need multiple special bits—it's often a sign of misconfiguration. Security scanners like Lynis and OpenSCAP will flag unexpected combinations of special bits as potential vulnerabilities.