Skip to content
Webmaster Tools
Dev utilitiesChmod Calculator664 (rw-rw-r--)

chmod 664 (rw-rw-r--)

chmod 664 lets the owner and group read and write a file, and everyone else read it. What rw-rw-r-- means, how umask 002 produces it, and when to use it.

Command
chmod 664 file
Open in the chmod calculator

What it means

chmod 664 gives the owner and the file's group read and write access, and everyone else read-only access. In ls -l it shows as -rw-rw-r--.

Who Digit Read Write Execute Symbolic
Owner (u) 6 yes yes no rw-
Group (g) 6 yes yes no rw-
Others (o) 4 yes no no r--

The symbolic equivalent:

chmod ug=rw,o=r README.md

It's chmod 644 plus write for the group.

Where 664 comes from

New files start from mode 666 and lose whatever bits the umask removes. With umask 022 you get 644. With umask 002, which only removes write for others, you get 664. Some distributions use 002 for regular users because each user has a private group of their own (the "user private group" scheme), so group write on your files only reaches you. Run umask to see yours; it can differ between login shells, cron jobs and services.

On a file

The owner and anyone in the group can edit the file. Every other user can read it. Nobody can run it, since no execute bit is set.

On a directory

664 is not usable on a directory: without execute (x), nobody can enter it or reach the files inside. The directory counterpart is chmod 775, or chmod 2775 for a shared directory where new files should keep the group.

Typical uses

  • Team-edited files. Several developers share a deploy directory and all belong to a web or dev group. 664 files in a 2775 directory let each of them edit and replace files the others created.
  • Files written by both a service and a human. A CMS running as www-data writes uploads, and an admin in the www-data group cleans them up.
  • Content that must stay readable to the web server when the web server is in "others", not in the group.

A shared setup looks like this:

sudo groupadd web
sudo usermod -aG web alice
sudo usermod -aG web bob
sudo chown -R root:web /srv/site
sudo find /srv/site -type d -exec chmod 2775 {} +
sudo find /srv/site -type f -exec chmod 664 {} +

Each user also needs umask 002 (set in their shell profile, or UMask=0002 in a systemd unit) so that new files come out 664 instead of 644.

Recursive pitfalls

chmod -R 664 dir removes execute from every subdirectory, and the whole tree becomes unreachable. Use find with -type d and -type f as above, or the symbolic X:

chmod -R ug=rwX,o=rX /srv/site

X adds execute only to directories and to files that already have it, so scripts keep working and plain files stay non-executable.

Security notes

  • Group write is only safe when you know exactly who is in the group (getent group web).
  • Don't use 664 on PHP or other code files the web server's group can reach unless you mean to. If the app runs as a member of that group, a bug that lets it write files lets it rewrite its own code.
  • Secrets don't belong at 664: everyone can read them. Use chmod 640 or chmod 600.

See how each bit maps in the chmod calculator.