# How secure is 666 as file-permission for a socket-file on web server

As a beginner, I am trying to deploy Flask web app, on a vps server, using Nginx as a reverse proxy and Uwsgi as HTTP server.
After creating a socket file in the web-app's root directory, which is chowned by the user, I noticed that the file-permission is 666.
Just wanted to know should I change it?

• Why did you use it? What did you hope to achieve? – muru Sep 26 '19 at 12:28
• @muru: Thanks for replying. It's the default file-permission, so I did not change it. – Mr.President Sep 26 '19 at 12:32
• If it's the default, then why did you chmod it? O.o – muru Sep 26 '19 at 12:45
• My bad, I by mistake posted that in the question. I only used chown. Editing the question right now. – Mr.President Sep 26 '19 at 12:49

Depends on what it is for, etc. The permissions 666 would show in a ls -l listing as -rw-rw-rw- (readable and writable by the owning user, the owning group, and any other user/process on the system) so anyone with access to the system could read and write to the file.

These permissions are somewhat loose - it isn't often that a file is open like that to all users on a system. Depending on exactly why you need the socket file it may be appropriate, or there may be a better way to only allow access to the user/group(s) that really need to access it.

• Thanks for replying. Should I remove both read and write for other users, as I do not want others to read/write or execute it? – Mr.President Sep 26 '19 at 13:22
• @Mr.President - I would recommend investigating how it is used and by which users/groups and then determine just how to organize things so that you give minimal exposure ... but it really depends on how it is being used. – ivanivan Sep 26 '19 at 13:38

Yes, this is probably insecure. This might be secure, when other users cannot access the parent folder (e.g. it has rights like 700 (rwx------)), otherwise everyone can read and write the socket.

But take care, why it is set up like this. When you used some deployment script, it may be written insecure, but fixing the modes may break the deployment, that may depend on the insecure modes for some reason.

• I am guessing, I should keep the permission for owning user, owning group and revoke everything for others ( -rw-rw----) ...is it ok? – Mr.President Sep 26 '19 at 13:37
• I think you may need to use 660 and chown the file for user.www-data (when nginx is in the group www-data), so both the process and nginx can read and write it. – allo Sep 26 '19 at 14:07