2000

SGID (Set Group ID)

SGID grants execution or directory access with group privileges inheritance. On files, it runs with the files **group permissions; on directories, **new files inherit the group instead of the users default group.

For WordPress servers, SGID is occasionally useful for controlled shared-group workflows, but dangerous if misapplied on web-writable paths.

Objective

Understand how **SGID (2000) works for files and directories, identify safe use, and enforce security in a WordPress VPS context.

Core Concept

SGID bit meaning

Digit	Meaning
2	Enable SGID bit

General Pattern

2xyz   # SGID + regular permission xyz

Common example:

2755   # SGID + 755

Effects

Target	Behavior
File	Executes with group privileges
Directory	Files created inside inherit directory’s group

Syntax Formula

Apply SGID

chmod 2xxx <file/dir>

Remove SGID

chmod g-s <file/dir>

Check SGID files/dirs

find / -perm -2000 2>/dev/null

Permission Indicator (ls Output)

File with SGID

-rwxr-sr-x

Directory with SGID

drwxr-sr-x

Note the **s replacing **x in group field.

Practical Examples

Example 1: SGID on directory for shared team folder

mkdir /srv/project
chgrp developers /srv/project
chmod 2775 /srv/project
ls -ld /srv/project

Expected:

drwxrwsr-x ... /srv/project

Example 2: SGID on executable script

chmod 2755 /usr/local/bin/maint-script
ls -l /usr/local/bin/maint-script

Expected:

-rwxr-sr-x ... maint-script

WordPress-Relevant Usage

Use Case	Recommendation
Shared deployment folder for dev/sysadmin	✅ Valid
Shared log directory for controlled team	✅ Valid
Public web directories (wp-content/uploads)	❌ Never
Plugin/theme directories	❌ Never
DB or backup folders	❌ Avoid: risk privilege abuse

**WP rule: SGID should **never touch writable web directories.

WordPress VPS Scenarios

Scenario	Action
Shared maintenance scripts between admin users	OK with SGID
Deploy pipeline generating files in shared group	OK
Shared editing inside /var/www or /home/{user	Prefer sudo + git
Uploads/media directory	Prohibited for SGID
Nginx/OLS + PHP user group mix	Use chown -R + correct groups instead

Security Considerations

Risks

Risk	Description
Privilege escalation	If group has high privilege roles
Group takeover	Files inherit wrong group
Web exploitation	Attackers gain group escalated write access

Audit

find / -perm -2000 2>/dev/null

Remove

chmod g-s /path

Prevention

• Limit to admin-controlled, non-public dirs
• Never expose to web-write paths (uploads, cache folders, tmp)

Best Practices

Practice	Reason
Use SGID only for internal controlled automation	Security
Use sudoers for admin escalation	Logged + safer
Keep /var/www user-isolated	Hardens WP environment
Prefer group-based ACLs for team access	More control

Example ACL:

setfacl -m g:dev:rwx /srv/project

WP Security Quick Audit

Scan only WP dirs:

find /home -perm -2000

If found in:

• wp-content
• plugin/theme directory
• user home under web folders

remove immediately.

chmod g-s <path>

Go-Live Checklist

Task	Done
No SGID on public directories	✅
Only trusted team groups allowed	✅
Sudoers rules defined	✅
WP user isolation enforced	✅
Weekly SGID audit in maintenance cron	✅

Troubleshooting Matrix

Symptom	Cause	Solution
Unexpected group for new files	SGID dir set	chmod g-s dir
Unauthorized shared access	Too permissive group	Fix perms/ACL
Exec inherits wrong group	Bad SGID on script	Remove SGID + sudoer

Quick Lab

Create group collaboration folder

groupadd webteam
mkdir /mnt/wpshare
chgrp webteam /mnt/wpshare
chmod 2775 /mnt/wpshare

Test:

• User creates file inherits webteam group

Cheat Sheet

Command	Purpose
chmod 2xxx	Set SGID
chmod g-s	Remove SGID
find / -perm -2000	Scan for SGID
ls -l	Check for s in group exec bit

Mini-Quiz

Question	Answer
What does 2xxx enable?	SGID
File vs dir behavior?	File = exec as group; Dir = inherit group
Safe for wp-content?	No
Indicator in ls -l?	s in group bit