chmod 660
chmod 660 sets rw-rw----: the owner and the group can read and write the file, nobody can execute it, and every other account has no access.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | No | 6 |
| Group (g) | Yes | Yes | No | 6 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read and modify | List names only; write does nothing without execute |
| Group (g) | Read and modify | List names only; write does nothing without execute |
| Others (o) | No access | No access |
Facts
| Octal | 660 (0660) |
|---|---|
| Symbolic | rw-rw---- |
| ls -l, file | -rw-rw---- |
| ls -l, directory | drw-rw---- |
| Equivalent symbolic command | chmod ug=rw,o= |
| Default umask that creates it | umask 007 for new files |
| How Git records a file with it | 100644 (not executable) |
| Special bits | None |
When to use it
- Access control by group for devices and sockets: serial ports such as /dev/ttyS0 are crw-rw---- root:dialout, and the Docker socket is srw-rw---- root:docker. Joining the group is how you get access.
- Databases or state files that a service and its operators both write, such as a SQLite file shared by an app and a cron job in the same group.
- It is what new files get under umask 007.
When not to use it
- Files the web server serves directly if its account is outside the group: it gets permission denied.
- When group members only need to read, such as config with credentials: use 640 so a compromised reader cannot also rewrite it.
Commands
chmod 660 app.sqlite
chmod ug=rw,o= app.sqlite # same resultstat -c '%a %A %n' app.sqlite # Linux (GNU stat): 660 -rw-rw----
stat -f '%Lp %Sp %N' app.sqlite # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 770 and files to 660 separately:
find . -type d -exec chmod 770 {} +
find . -type f -exec chmod 660 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R ug=rwX,o= ..
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100644; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 660 mean?
- Owner 6 (rw-), group 6 (rw-), others 0 (---). Only the owner and group members can use the file.
- Why can I not use /dev/ttyUSB0 or docker without sudo?
- Both are 660 and owned by a group (dialout or uucp for serial ports, docker for the socket). Add yourself with sudo usermod -aG dialout $USER and log in again. Note that docker group membership is equivalent to root.
- Should I use 660 or 640?
- 660 when the group writes, 640 when it only reads.
Last reviewed by Arielton Oberek.