chmod 777: Everyone Gets Everything
777 is rwxrwxrwx: every account on the system can read, modify and execute the file, or list, enter and delete inside the directory. It is the most common desperation fix and almost never the correct one.
At a glance
- Octal
- 777, written 0777 in four digit form
- Symbolic
- u=rwx,g=rwx,o=rwx
- On a file
- -rwxrwxrwx
- On a directory
- drwxrwxrwx
- Owner
- Read, write, execute
- Group
- Read, write, execute
- Others
- Read, write, execute. Every local account, including service accounts
In detail
On a file, 777 means any account on the machine can overwrite the contents and run it. On a directory it means anyone can list the names inside, enter it, create new entries, and delete or rename existing ones regardless of who owns them, because deletion is controlled by write permission on the directory and not by ownership of the file being deleted.
It usually appears after a permission denied error, applied as a guess. That guess almost always hides the real cause, which is ownership: the process is running as a user that is neither the owner nor in the owning group. Fixing the owner with chown, or adding the service account to the right group, solves the problem without opening the file to everything else on the box.
The security consequence is concrete rather than theoretical. A 777 directory under a web root lets any process on the machine drop a file there, and if that directory is served or executed, that is remote code execution by the shortest possible path. A 777 configuration file lets any compromised process rewrite your database credentials and wait.
There is one narrow case where world write is legitimate: a shared scratch directory such as /tmp. That is not plain 777, it is 1777, with the sticky bit added so that users can only delete their own entries. If you find yourself wanting 777 on a shared directory, what you actually want is 1777, or 2775 with a shared group.
The calculator flags 777 with a security warning for exactly this reason, and it is one of the eleven presets so you can see the resulting ls -l rendering next to a safer alternative. Set 775 or 755 alongside it and compare the two symbolic strings; the difference is usually the whole answer.
Examples
chmod 777 shared.txt
chmod u=rwx,g=rwx,o=rwx shared.txtBoth are absolute: they set the mode outright rather than adding to whatever was there before.
drwxrwxrwx 2 alice alice 4096 uploads/
$ whoami
mallory
$ rm uploads/alice-report.pdf # allowed
$ mv uploads/config.php /tmp/ # allowed
Deletion is granted by write on the directory, not by
ownership of the file inside it.# wrong
chmod -R 777 /var/www/app
# right: give the running user ownership, keep the mode tight
chown -R deploy:www-data /var/www/app
chmod -R 750 /var/www/appThings that catch people out
- chmod 777 on a directory does not make files created inside it 777. New files get their mode from the creating process and the umask, so the directory stays wide open while the files inside look fine.
- Recursively applying 777 to a source tree marks every text file executable, which breaks tooling that checks the execute bit and makes every file in git show up as a mode change.
- 777 on a directory without the sticky bit lets any user delete any other user's files in it. That is why /tmp is 1777 and not 777.
- Some SSH, cron and mail daemons refuse to use files or directories that are group or world writable, so 777 can turn a permission problem into a silent refusal that logs nothing obvious.
Try it: Chmod Calculator
Tick the nine permission boxes, or type an octal or symbolic value, and get the three digit and four digit octal, the ls -l rendering and the exact chmod command back.
Chmod Calculator
LOCAL · Browser-OnlyCalculate Unix file permissions with an interactive chmod builder
Permission Matrix
| Entity | Read (4) | Write (2) | Execute (1) | Octal | Symbolic |
|---|---|---|---|---|---|
| Owner (u) | 7 | rwx | |||
| Group (g) | 5 | r-x | |||
| Others (o) | 5 | r-x |
Special Bits
Advanced permission flags for executables and directories
Generated Permissions
755rwxr-xr-x-rwxr-xr-xchmod 755 filenamechmod u=rwx,g=rx,o=rx filenamePermission Breakdown
Owner (u)
7rwx- - Read files / list directory contents
- - Write / modify / delete
- - Execute / traverse directory
Group (g)
5r-x- - Read files / list directory contents
- - Execute / traverse directory
Others (o)
5r-x- - Read files / list directory contents
- - Execute / traverse directory
Common Permissions Reference
| Octal | Symbolic | Meaning |
|---|---|---|
777 | rwxrwxrwx | Full access for everyone |
755 | rwxr-xr-x | Owner full, others read and execute |
750 | rwxr-x--- | Owner full, group read and execute |
700 | rwx------ | Owner full access only |
666 | rw-rw-rw- | Read and write for everyone |
644 | rw-r--r-- | Owner read/write, others read only |
600 | rw------- | Owner read/write only |
555 | r-xr-xr-x | Read and execute for everyone |
444 | r--r--r-- | Read only for everyone |
400 | r-------- | Owner read only |
Related File permissions
All file permissions →chmod 1777: The Sticky Bit and Why /tmp Needs It
1777 adds the sticky bit to a world writable directory so only a file's owner can delete it. The mode of /tmp and the fix for any shared drop directory.
chmod 775: Owner and Group Write, Everyone Else Reads
775 gives the owner and group full access and leaves others with read and execute. The correct mode for shared directories, and why it needs setgid.
chmod 755: The Standard Mode for Directories and Programs
755 gives the owner full control and everyone else read and execute. Why it is right for directories and executables and wrong for ordinary data files.
chmod 666: World Writable Files and the Few Legitimate Ones
666 lets every account read and write the file with no execute bit anywhere. Why it is wrong for regular files and right for a handful of device nodes.
chmod 750: Owner Writes, Group Reads, Others Shut Out
750 gives the owner everything, the group read and traverse, and everyone else nothing. The right mode for application directories that must stay private.
chmod 711: Directories You Can Enter but Cannot List
711 gives others execute without read, so they can enter a directory by exact name but cannot list it. Where this is used and what it does not protect.
Tools for this
- Chmod Calculator Free online chmod calculator - calculate Unix file permissions with an interactive chmod builder