chmod 622: Write Without Read, and the Old Terminal Mode

Write without read is a real capability and an uncomfortable one. An account with the write bit and not the read bit can truncate the file to nothing, append to it, or overwrite it from the start, but cannot open it to see what was there. It is destructive access without visibility, which is why almost nothing is designed around it.

Its historical home is the terminal device. On older systems the write utility was not setgid, so allowing other users to send a message to your terminal meant opening the device itself to everyone, and mesg y produced a 622 device node. Current systems use a setgid write program with the terminal owned by the tty group at 620, which grants the same thing to one small group instead of to the world.

As an append only log this does not work either, despite the appeal of the idea. Nothing in the mode forces appending: a process with write permission can seek to the beginning and overwrite. Append only behaviour comes from opening the file with the append flag, or from the file attribute set by chattr +a, not from the permission bits.

On a directory, 622 is inert. No class has the execute bit, so nothing can traverse into it, and the write bits that appear to allow creating entries cannot be exercised because the path cannot be resolved. As with every unusable directory mode, the digits look meaningful and the behaviour is a flat refusal.

If you have found 622 on a regular file, it is worth treating as an incident rather than a curiosity. It is not a mode any package sets, and world write on anything is a finding in its own right. Decide who really needs to write, give that group the access explicitly, and take the others bits back to zero.