Quick answer

SGID (set group ID) has two effects. On an executable, it runs with the file's group privileges. On a directory, new files created inside inherit that directory's group. An abusable SGID binary can widen access the same way SUID does, just via group membership.

What is SGID (set group ID)?#

On a file, the SGID bit makes the process run with the file's group. On a directory, it makes newly-created files inherit the directory's group rather than the creator's primary group. In ls -l it appears as an s in the group-execute position, e.g. -rwxr-sr-x.

Why LinPEAS checks sgid#

LinPEAS lists SGID binaries alongside SUID. If a SGID binary's group has access to something sensitive, abusing that binary can leverage the group's privileges. SGID directories matter for collaborative areas and can affect who can read newly-created files.

What a normal configuration looks like#

A handful of standard SGID binaries exist (e.g. wall, write, some mail tools). SGID directories are common for shared project folders where a consistent group is wanted.

Why it can be security-sensitive#

A SGID binary whose group can read secrets (e.g. the shadow group) or write to privileged locations can be an escalation. SGID directories with a powerful group can expose newly-created files to unintended readers.

From highlight to verdict

Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

Find SGID binaries
find / -perm -2000 -type f 2>/dev/null
Find SGID directories
find / -perm -2000 -type d 2>/dev/null
Show group ownership
ls -l $(find / -perm -2000 -type f 2>/dev/null)

Defensive remediation#

  • Remove SGID where unnecessary: chmod g-s <file>.
  • Ensure SGID binaries' groups do not grant access to secrets.
  • Review SGID directories that use privileged groups.

Sources & references

  1. HackTricks: Linux privilege escalation
  2. GTFOBins — abuse techniques for standard binaries
  3. PEASS-ng repository — reviewed 20260908-dffb9496