chmod 664: a file the owner and its group can both edit

What chmod 664 means

In 664 the first digit is the owner, the second the group and the third everyone else: the owner gets read and write, the group gets read and write, and others get read only.

ls -l shows -rw-rw-r--. It is what a new file gets when the umask is 002, a setting common on distributions that give each user a private group of the same name, because then group write only reaches the user themself unless the file belongs to a shared group.

Shared project files

664 is the file half of a collaborative directory. Create a group, add the people or services that need to write, chgrp -R team /srv/project, then use 2775 on directories — the 2 is setgid, so new files inherit the team group — and 664 on files. Without the setgid bit, each new file takes the creator's primary group and the sharing quietly stops working.

A process that writes into such a tree should run with umask 002, or the files it creates will come out as 644 and other members lose write.

When not to use it

The last digit still grants read to every account, so 664 is wrong for secrets. If the group should be the only reader, drop to 660. If the file is a program the group runs, use 775 instead so it gains execute.

And 664 is only as narrow as the group: check membership with getent group <name>. A broad group such as users turns 664 into a file most of the machine can edit.

Related values

Every neighbour of 664 changes one digit. 644 takes group write away, the right mode when only the owner edits. 666 adds write for everyone, which defeats the purpose of having a group. 640 keeps the group but removes the world's read access, and 660 (not covered here) does the same while keeping group write. For a group-run script, use 775, or 755 if only the owner should change it.