chmod `666` — what does it mean?

666 is the mode programs request when they create a regular file; your umask then removes bits, which is why you normally end up with 644 or 664. Left as-is, it means any account and any process can change the file's contents. That is correct for a handful of device files such as /dev/null, /dev/zero and /dev/tty, and almost never correct for a file on disk.

In plain English

666

rw-rw-rw-

Every user on the system can read and modify the file; nobody can execute it.

Symbolic equivalent: chmod u=rw,g=rw,o=rw app.log

Open 666 in the chmod calculator

What each digit in 666 means

Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.

Class	Digit	Sum	r w x	ls -l
Owner (u)	6	4 + 2 + 0	rw-	rw-
Group (g)	6	4 + 2 + 0	rw-	rw-
Others (o)	6	4 + 2 + 0	rw-	rw-

Owner: can read the contents and modify the contents; no execute.
Group: can read the contents and modify the contents; no execute.
Others: can read the contents and modify the contents; no execute.

When to use chmod 666

Character devices meant for everyone: /dev/null, /dev/zero, /dev/random, /dev/urandom and /dev/tty are crw-rw-rw-.
Throwaway files in a sticky /tmp that several users must append to during a debugging session. Delete them afterwards.
It is not a good choice for logs, sockets or config. Use a group and 660/664 instead.

Security risks and gotchas

Anyone can change or empty the file

A world-writable config file lets any local user or compromised service change how your app behaves. A world-writable log can be truncated to hide activity or filled with forged entries.

Worse if anything privileged reads it

If root or a cron job sources a 666 shell file, includes a 666 PHP file, or loads a 666 config, any user can inject commands into that privileged process.

666 is not 'read and write but safe'

People reach for 666 to fix 'Permission denied' when two services share a file. The safer fix is a shared group with 660 (or 664 if others may read).

sudo chgrp appgroup /var/log/app.log
chmod 660 /var/log/app.log

Commands

Set 666 (rarely what you want)

chmod 666 app.log

Equivalent to chmod a=rw app.log.

Remove world write

chmod o-w app.log

Turns 666 into 664 without touching owner and group bits.

Find world-writable regular files

find / -xdev -type f -perm -0002 -ls 2>/dev/null

Run it on servers you manage; anything outside /tmp-style directories deserves a look.

How to check for 666

# Symbolic view
ls -l app.log
-rw-rw-rw-  1 deploy deploy  48211 Oct 16 09:12 app.log

# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' app.log
666 -rw-rw-rw- app.log

# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' app.log

The first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.

Related chmod modes

664rw-rw-r--

Owner and group read and write, others read-only

644rw-r--r--

Owner read and write, everyone else read-only

777rwxrwxrwx

Everyone can read, write and execute

600rw-------

Owner read and write only

Try variations of 666 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.

Frequently Asked Questions

What does chmod 666 mean?▾

Read and write (4+2 = 6) for the owner, the group and everyone else: rw-rw-rw-. Nobody gets execute.

Why is /dev/null 666?▾

Every program, whatever user it runs as, must be able to write to /dev/null to discard output and read from it to get an empty input. It is a device, so writing to it cannot change anything for other users.

What should I use instead of 666?▾

644 if only the owner writes, 664 or 660 if a group of users or services must write, and 600 for anything private. Put the processes that share the file into one group rather than opening it to everyone.

chmod 666 — what does it mean?