Meaning of the access permissions "rws" and "root root" of /usr/bin/sudo

Question

In the following access permissions, I am not sure what the second "root" stands for.

The first one is the owner who has permissions rws (what does s stand for?) and the second one is the group named root. Is it a special group in which only the root user is member?

$ ls -l /usr/bin/sudo
-rwsr-xr-x 1 root root 157760 Jan 11 2016 /usr/bin/sudo

If I am wrong, then what is the meaning of the above access permissions?

Solution

The s in rws stands for setuid meaning set user ID. This is a special permission bit that allows the program, when run by any user, to be run with the effective UID of the owner, in this case, root. So when you as a normal user run the sudo executable, you effectively do so as root. This permission bit is a security risk, and should only be applied where absolutely necessary.

Explanation of the setuid bit from The Linux Command Line by William E. Shotts Jr:

When applied to an executable file, it sets the effective user ID from that of the real user (the user actually running the program) to that of the program's owner. Most often this is given to a few programs owned by the superuser. When an ordinary user runs a program that is "setuid root" , the program runs with the effective privileges of the superuser. This allows the program to access files and directories that an ordinary user would normally be prohibited from accessing. Clearly, because this raises security concerns, the number of setuid programs must be held to an absolute minimum.

The second root in the listing is the group that owns the file, and yes, only the user root is in the group root:

$ getent group root
root:x:0:

Here's an example of a file that has different user and group ownership:

-rw-r----- 1 root shadow 1456 Nov 22 20:08 /etc/shadow

This means that the file can be read and written to only by root, but members of the group shadow may also read the file.

Comments

[AnotherKiwiGuy]

You can find some good information about File Attributes here

[Zanna]

@ThatGuy <3 the Arch wiki. I think our permissions tag wiki is quite helpful too.

[AnotherKiwiGuy]

@Zanna Oh excellent! I'll have to have a browse around :)