chmod 766: A Mode That Is Almost Always an Accident
766 is rwxrw-rw-: the owner can read, write and execute, and both the group and everyone else can read and write. It is world writable, which is the serious part, and executable only by the owner, which is the confused part.
At a glance
- Octal
- 766, written 0766 in four digit form
- Symbolic
- u=rwx,g=rw,o=rw
- On a file
- -rwxrw-rw-
- On a directory
- drwxrw-rw-
- Owner
- Read, write, execute
- Group
- Read and write, no execute
- Others
- Read and write, no execute. Any local account can rewrite the contents
In detail
The world writable half is the part that matters. Any account on the machine, including any service account a compromised process is running as, can replace the contents of this file. If it is a configuration file, credentials can be swapped. If it is a script that something privileged runs later, the content can be replaced with anything and the mode change will not be logged.
The execute half is a different kind of wrong. Execute is set for the owner only, which on a data file does nothing at all and on a script means only the owner can run it while everyone can rewrite it. That combination is not something anyone designs; it is what you get from adding permissions one at a time until an error stops appearing.
On a directory 766 is worse than useless: the missing execute bit for group and others means they cannot traverse into it, yet the write bit says they may create entries. In practice they can do neither usefully, because creating an entry requires resolving the directory path first. The directory becomes both open and unusable.
What was probably intended is one of three things: 755 if the file is a program that others should run, 644 if it is data that others should read, or 664 with a shared group if a team genuinely needs to edit it. Pick whichever of those matches the file's actual job and the confusion disappears.
The same reasoning covers 776, which is 766 with execute added for the group. It has the identical world writable problem and no additional purpose, so it is not given its own page here. If you landed on 776, read this page and then choose one of the three replacements above.
Examples
chmod 766 notes.txt
chmod u=rwx,g=rw,o=rw notes.txt-rwxrw-rw- 1 alice alice notes.txt # 766, world writable
# data that others read
chmod 644 notes.txt -> -rw-r--r--
# data a team edits
chmod 664 notes.txt -> -rw-rw-r--
# a program others run
chmod 755 notes.txt -> -rwxr-xr-xThings that catch people out
- World writable files are flagged by every hardening benchmark and most compliance scans, so 766 will generate findings even where the file itself is harmless.
- A world writable script that is executed by a scheduled job running as another user is a direct privilege escalation path. The execute bit belonging only to the owner does not prevent that, because the scheduler runs the interpreter against the file.
- 766 on a directory blocks traversal for group and others, so the write bit they appear to have cannot actually be used. The mode reads as permissive and behaves as broken.
- This mode usually arrives from a chmod applied to fix an unrelated error. Find out which process was denied and what user it runs as, rather than widening the mode again.
Try it: Chmod Calculator
Tick the nine permission boxes, or type an octal or symbolic value, and get the three digit and four digit octal, the ls -l rendering and the exact chmod command back.
Chmod Calculator
LOCAL · Browser-OnlyCalculate Unix file permissions with an interactive chmod builder
Permission Matrix
| Entity | Read (4) | Write (2) | Execute (1) | Octal | Symbolic |
|---|---|---|---|---|---|
| Owner (u) | 7 | rwx | |||
| Group (g) | 5 | r-x | |||
| Others (o) | 5 | r-x |
Special Bits
Advanced permission flags for executables and directories
Generated Permissions
755rwxr-xr-x-rwxr-xr-xchmod 755 filenamechmod u=rwx,g=rx,o=rx filenamePermission Breakdown
Owner (u)
7rwx- - Read files / list directory contents
- - Write / modify / delete
- - Execute / traverse directory
Group (g)
5r-x- - Read files / list directory contents
- - Execute / traverse directory
Others (o)
5r-x- - Read files / list directory contents
- - Execute / traverse directory
Common Permissions Reference
| Octal | Symbolic | Meaning |
|---|---|---|
777 | rwxrwxrwx | Full access for everyone |
755 | rwxr-xr-x | Owner full, others read and execute |
750 | rwxr-x--- | Owner full, group read and execute |
700 | rwx------ | Owner full access only |
666 | rw-rw-rw- | Read and write for everyone |
644 | rw-r--r-- | Owner read/write, others read only |
600 | rw------- | Owner read/write only |
555 | r-xr-xr-x | Read and execute for everyone |
444 | r--r--r-- | Read only for everyone |
400 | r-------- | Owner read only |
Related File permissions
All file permissions →chmod 644: The Default File Mode and When to Change It
644 gives the owner read and write and everyone else read only. Why it is the default for files under a 022 umask, and the cases where it is wrong.
chmod 664: Group Writable Files for Shared Work
664 lets the owner and the group edit a file while everyone else can only read it. The default on systems using a 002 umask and per-user groups.
chmod 755: The Standard Mode for Directories and Programs
755 gives the owner full control and everyone else read and execute. Why it is right for directories and executables and wrong for ordinary data files.
chmod 666: World Writable Files and the Few Legitimate Ones
666 lets every account read and write the file with no execute bit anywhere. Why it is wrong for regular files and right for a handful of device nodes.
chmod 700: Private Directories Such as ~/.ssh
700 gives the owner read, write and execute and everyone else nothing. Why SSH insists on it for ~/.ssh and what breaks when a parent is more open.
chmod 640: Configuration Files a Service Group Can Read
640 gives the owner read and write, the group read only, and everyone else nothing. The correct mode for configuration holding credentials.
Tools for this
- Chmod Calculator Free online chmod calculator - calculate Unix file permissions with an interactive chmod builder