chmod 666: World Writable Files and the Few Legitimate Ones
666 is rw-rw-rw-: everyone can read and write, nobody can execute. On a regular file it is a serious mistake, and on a small set of character devices such as /dev/null it is exactly correct.
At a glance
- Octal
- 666, written 0666 in four digit form
- Symbolic
- u=rw,g=rw,o=rw
- On a file
- -rw-rw-rw-
- On a directory
- drw-rw-rw-, which cannot be entered by anyone
- Owner
- Read and write
- Group
- Read and write
- Others
- Read and write. Every local account can change the contents
In detail
On a regular file, 666 means any account on the machine can rewrite the contents. Nothing about the file being non executable helps: a configuration file can have its database host swapped, a data file can be corrupted, a log file can be truncated to hide activity, and none of it requires any privilege beyond having a shell on the box.
It is also the base permission the kernel starts from when a process creates a file. Open with mode 0666 and a umask of 022 produces 644 on disk. This is why files never come out executable by default: the creation base for files is 666 and for directories is 777, and the umask only ever subtracts.
The legitimate use is device nodes. /dev/null, /dev/zero, /dev/full and /dev/random are all crw-rw-rw-, because every process needs to write to the bit bucket or read entropy and there is nothing to protect. That is a special case of a character device with no state, not a precedent for regular files.
On a directory, 666 is broken rather than dangerous. Without the execute bit nobody, including the owner, can traverse into it, so the write permission cannot be exercised and even ls -l inside it fails to stat anything. A directory needs execute to be usable, which is why directory modes almost always end in an odd digit or a 5.
The calculator raises a security warning for 666 and for any mode that leaves the world write bit set. If you got here from a permission denied, the fix is nearly always ownership or group membership. Widening to 666 makes the error go away and leaves every other account on the machine holding the pen.
Examples
chmod 666 data.log
chmod u=rw,g=rw,o=rw data.logcrw-rw-rw- 1 root root 1, 3 /dev/null
crw-rw-rw- 1 root root 1, 5 /dev/zero
crw-rw-rw- 1 root root 1, 8 /dev/random
The leading c marks a character device. These hold no data
to protect, so world write is the right answer.base mode for a new file 666
umask 022
resulting mode on disk 644
base mode for a new directory 777
umask 022
resulting mode on disk 755Things that catch people out
- 666 on a log file lets any account truncate it, which destroys the audit trail you would need to work out what happened.
- A world writable file inside a directory the owner controls is still world writable. Directory permissions do not restrict writes to a file whose own mode allows them, only the ability to reach it.
- 666 on a directory makes it unusable for everyone including the owner, because traversal needs the execute bit. If you meant a shared directory, you wanted 775, 1777 or 2775.
- Hardening benchmarks scan specifically for world writable regular files. 666 will be reported every time, and 'it is only a cache file' is not usually accepted as a resolution.
Try it: Chmod Calculator
Tick the nine permission boxes, or type an octal or symbolic value, and get the three digit and four digit octal, the ls -l rendering and the exact chmod command back.
Chmod Calculator
LOCAL · Browser-OnlyCalculate Unix file permissions with an interactive chmod builder
Permission Matrix
| Entity | Read (4) | Write (2) | Execute (1) | Octal | Symbolic |
|---|---|---|---|---|---|
| Owner (u) | 7 | rwx | |||
| Group (g) | 5 | r-x | |||
| Others (o) | 5 | r-x |
Special Bits
Advanced permission flags for executables and directories
Generated Permissions
755rwxr-xr-x-rwxr-xr-xchmod 755 filenamechmod u=rwx,g=rx,o=rx filenamePermission Breakdown
Owner (u)
7rwx- - Read files / list directory contents
- - Write / modify / delete
- - Execute / traverse directory
Group (g)
5r-x- - Read files / list directory contents
- - Execute / traverse directory
Others (o)
5r-x- - Read files / list directory contents
- - Execute / traverse directory
Common Permissions Reference
| Octal | Symbolic | Meaning |
|---|---|---|
777 | rwxrwxrwx | Full access for everyone |
755 | rwxr-xr-x | Owner full, others read and execute |
750 | rwxr-x--- | Owner full, group read and execute |
700 | rwx------ | Owner full access only |
666 | rw-rw-rw- | Read and write for everyone |
644 | rw-r--r-- | Owner read/write, others read only |
600 | rw------- | Owner read/write only |
555 | r-xr-xr-x | Read and execute for everyone |
444 | r--r--r-- | Read only for everyone |
400 | r-------- | Owner read only |
Related File permissions
All file permissions →chmod 644: The Default File Mode and When to Change It
644 gives the owner read and write and everyone else read only. Why it is the default for files under a 022 umask, and the cases where it is wrong.
chmod 664: Group Writable Files for Shared Work
664 lets the owner and the group edit a file while everyone else can only read it. The default on systems using a 002 umask and per-user groups.
chmod 777: Everyone Gets Everything
777 gives read, write and execute to the owner, the group and everyone else. What it actually allows, why it is never the real fix, and what to use instead.
umask: How the Default Mode of a New File Is Decided
umask removes permission bits from newly created files and directories. Why 022 gives 644 and 755, and why a new file is never executable.
chmod 640: Configuration Files a Service Group Can Read
640 gives the owner read and write, the group read only, and everyone else nothing. The correct mode for configuration holding credentials.
chmod 622: Write Without Read, and the Old Terminal Mode
622 lets the owner read and write while the group and others can only write. Where this came from, what write without read really allows, and why it is rare.
Tools for this
- Chmod Calculator Free online chmod calculator - calculate Unix file permissions with an interactive chmod builder