The Script
Paste this into a file called permissions-audit.sh. It scans a target directory for world-writable files and saves a report when it finds them.
What this script checks
find "$SCAN_DIR" -perm "$DANGEROUS_PERMS" -type f searches for files with exact 777 permissions. Those files are world-writable, which means any user or compromised process can overwrite them.
Step-by-Step Setup
Step 1 — Create the script file
Paste the script above, then press Ctrl+X → Y → Enter to save.
Step 2 — Set your scan directory
The script accepts a directory as an argument. No editing required — just pass the path when you run it:
| Target directory | What it scans |
|---|---|
/var/www | Web server files — the most common audit target |
/home | All user home directories |
/etc | System config files — should never be world-writable |
/srv | Hosted application data |
Step 3 — Make it executable and run the audit
If any 777 files are found, you will see:
If nothing is found, you get a clean result:
Step 4 — Fix flagged files
For each file in the report, apply the correct permission based on its type:
Run the audit again after fixing to confirm the report is clean:
chmod Basics
Octal mode
7 = rwx (read+write+execute) 6 = rw- (read+write) 5 = r-x (read+execute) 4 = r-- (read only) 0 = --- (no permissions)
Format: chmod [owner][group][other] file
Symbolic mode
Common Permission Patterns
| Pattern | Octal | Use Case |
|---|---|---|
| rw-r--r-- | 644 | Regular files, configs, web assets |
| rwxr-xr-x | 755 | Directories, executables, scripts |
| rw------- | 600 | SSH private keys, secrets |
| rwx------ | 700 | Private directories |
| rw-rw-r-- | 664 | Shared group files |
Recursive Changes
Recursive permission changes are where people usually break deploys. Directories need the execute bit so users and processes can enter them.
Never use chmod -R 777
chmod -R 777 makes everything world-writable. On a shared server or web host, that means anyone who can run code as another user can overwrite your files, plant backdoors, or break your app.
Auditing with find
find is the permission audit tool you already have installed. These searches help you spot dangerous files before they become incidents.
chown — Changing Ownership
Permissions decide what the owner, group, and everyone else can do. chown changes who the owner and group are.
Common Mistakes
Never use chmod -R 777
chmod -R 777 makes everything world-writable. On a shared server or web host, that means anyone who can run code as another user can overwrite your files, plant backdoors, or break your app.
Safe permissions to memorize
SSH private keys must be 600 — SSH will refuse to use them otherwise. Web files: 644 for files, 755 for directories. Use find + -exec instead of chmod -R to avoid breaking directory execute bits. Audit world-writable files on new servers immediately.
Frequently Asked Questions
How do I find world-writable files in Linux?
Run: find / -perm -o+w -type f 2>/dev/null. The -o+w flag matches any file where the "other" category has write permission. On a web server, scope it to the web root: find /var/www -perm -o+w -type f.
What file permissions should a web server use?
Files should be 644 (owner can read/write, everyone else read-only). Directories should be 755 (owner can enter and write, others can only enter and read). Never use 777 on a shared or internet-facing server.
How do I fix file permissions recursively without breaking directories?
Use two find commands — one for files, one for directories:
chmod -R 644 breaks directories by removing their execute bit, which prevents anyone from entering them.
What is a SUID file and why is it a security risk?
SUID (Set User ID) means the file runs as its owner's permissions rather than the caller's. On a root-owned binary, that means any user who can run it gets root-level access for that execution. Find them with: find / -perm -4000 -type f 2>/dev/null.
What does chmod 600 do?
chmod 600 gives the file owner read and write permission, and removes all access from the group and others. It is the required permission for SSH private keys — SSH will refuse to use a key with looser permissions.
