chmod 666 (rw-rw-rw-)

What it means

chmod 666 gives read and write access to the owner, the group and every other user. Nobody can execute the file. In ls -l it shows as -rw-rw-rw-.

The symbolic equivalent:

chmod a=rw file

666 is the starting point, not the goal

When a program creates a regular file, it usually asks for mode 666, and the kernel removes the bits in your umask. With umask 022 you end up with 644, with 002 you get 664. That's why 666 shows up in explanations of umask: it's the "before" value, not something you normally want on disk.

On a file

Any account on the machine can read the file, change it, empty it or replace its contents. That includes every system service and any process an attacker manages to run as an unprivileged user.

On a directory

666 on a directory is broken: no execute (x) bit means nobody can enter it. A world-writable directory would be chmod 777, or chmod 1777 if users shouldn't be able to delete each other's files.

Where Linux legitimately uses it

Some device files are 666 by design, because every user is supposed to be able to use them and writing to them can't harm anyone:

These are special files whose behavior is set by the kernel. A regular file at 666 is a different story.

Why it's a problem on regular files

• Config and code. If a script, cron job or .htaccess file is world-writable, any local user can change what it does. If root or the web server then runs it, that user gains those privileges.
• Logs. A world-writable log can be wiped or filled with fake entries.
• Data files. Anyone can corrupt or replace them, and you won't know who did it.

You can find world-writable files with:

find /var/www /etc /home -xdev -type f -perm -0002 -ls 2>/dev/null

What to use instead

666 usually appears as a fix for "Permission denied" when two users or a user and a service share a file. The better fix is a group:

sudo chown alice:www-data shared.json
sudo chmod 664 shared.json   # or 660 if others shouldn't read it

Put both accounts in the group, and only they get write access. See chmod 660 and chmod 664.

If a program you don't control creates files as 666, check its umask: for a systemd service, UMask=0027 in the unit file gives files 640 by default. For a socket that every local user must reach, 666 can be the intended design, but check that the service behind it authenticates its clients.

Recursive pitfalls

chmod -R 666 takes execute off every directory below, so the tree stops working on top of being writable by everyone. If you need to undo a wide chmod, reset files and directories separately:

find dir -type d -exec chmod 755 {} +
find dir -type f -exec chmod 644 {} +

Related modes

• chmod 644: the safe default for files.
• chmod 664: writable by the owner and the group.
• chmod 777: the directory and executable version of this mistake.

Enter a safer mode in the chmod calculator to see exactly which bits change.