chmod 775

chmod 775 sets the mode to rwxrwxr-x: the owner and the group can read, write and execute (7), and everyone else can read and execute (5). It’s 755 with write added for the group, and it’s meant for directories that a team, or a deploy user and a service, both change.

What group write means on a directory

On a directory, write together with execute lets a user create, rename and delete entries. So in a 775 directory every member of its group can add files, and can also delete or rename any file there, including files they don’t own and can’t read. Others can list it and open what’s inside, but not change it.

On a file, 775 lets the group edit and run it. That’s what umask 002 gives executables, which some distributions use for users who have a private group of their own.

A shared directory

sudo groupadd devs
sudo usermod -aG devs alice           # takes effect at alice's next login
sudo chgrp devs /srv/project
sudo chmod 775 /srv/project
ls -ld /srv/project                   # drwxrwxr-x 2 root devs 4096 Oct 15 09:00 /srv/project

One thing 775 won’t do: files created inside get the creator’s primary group, not devs, so teammates soon can’t edit each other’s work. Add the setgid bit, making it 2775, and new files and subdirectories take the directory’s group. For a tree that already exists, split files and directories:

sudo chgrp -R devs /srv/project
sudo find /srv/project -type d -exec chmod 2775 {} +
sudo find /srv/project -type f -exec chmod 664 {} +

Where group write bites

• Home directories. sshd’s StrictModes, on by default, rejects key logins when your home directory or ~/.ssh is group-writable, and logs Authentication refused: bad ownership or modes for directory. Never chmod 775 ~.
• Anything a privileged process runs. A group-writable directory in root’s PATH, or one holding cron scripts, lets every group member substitute code that then runs as root.
• Deletion. If members should only remove their own files, add the sticky bit: chmod +t turns 2775 into 3775.
• Others can still read. Make it 770 when the contents aren’t for every local user.

In containers and git

• OpenShift runs containers as an arbitrary UID in the root group, so images make writable paths group-owned by 0 and give the group the owner’s bits: RUN chgrp -R 0 /app && chmod -R g=u /app, which turns 755 into 775.
• Kubernetes: securityContext.fsGroup makes a supporting volume group-owned by that GID, sets setgid on its directories and adds group read and write, so you don’t have to.
• Git stores neither group bits nor directory modes. A 775 script is committed as 100755 and checked out as 755 under umask 022.