chmod 664

chmod 664 sets the mode to rw-rw-r--: the owner and the group can read and write (6), and everyone else can only read (4). It’s 644 with write for the group: the mode for files that several people, or a deploy user and a service, edit in a shared directory.

What it allows

$ ls -l /srv/project/notes.md
-rw-rw-r-- 1 alice devs 812 Oct 15 09:00 /srv/project/notes.md

Alice and every member of devs can change notes.md; everyone else can read it; nobody can run it. On systems that give each user a private group of the same name, the group bits only matter once the file’s group is a shared one like devs.

Getting 664 on new files

The mode of a new file comes from the program that creates it and that program’s umask, not from the directory’s mode. Under the common umask 022, a file created in a shared directory is 644, and the rest of the group can’t edit it. Three fixes:

• umask 002 for the people and services involved: 666 with 002 cleared is 664, and directories become 775. Set it in the shell profile, or with UMask=0002 in a systemd unit.
• A default ACL on the directory, which takes the umask’s place for files created inside it: setfacl -d -m g::rwX /srv/project.
• Git’s shared repositories: git init --bare --shared=group makes the repository’s files group-writable and its directories setgid, whatever each pusher’s umask is.

Pair it with a setgid directory (2775) so new files also land in the right group, and fix an existing tree in two passes:

sudo chgrp -R devs /srv/project
sudo find /srv/project -type f -exec chmod 664 {} +
sudo find /srv/project -type d -exec chmod 2775 {} +

The risks of a group-writable file

• Group membership becomes power. If root, cron or a service reads a group-writable config or runs a group-writable script, every member of that group can change what it does.
• Some tools refuse it. sshd’s StrictModes rejects an authorized_keys that the group can write.
• Others can read. 664 is no place for secrets; use 660, or 640 if the group only reads.

In git and containers

Git records 664 as 100644, and a clone gets 644 under umask 022: it never stores group bits. In Kubernetes, defaultMode: 0664 (436 in JSON) sets it on Secret and ConfigMap files, but those volumes are mounted read-only, so the group’s write has no effect there.