chmod 770 (rwxrwx---)

When to use 770

Group-shared directories and tools, locked out from everyone else. 770 (rwxrwx---) gives the owner and the group full read/write/execute while others get nothing. It's the natural mode for a directory a specific team must collaborate in but no one else on the box should even enter.
Deploy or service directories scoped to a service group. A directory owned by deploy:webteam at 770 lets the deploy user and every webteam member create, edit, and traverse, while unrelated accounts can't list or reach it. Pair the directory's group ownership carefully — 770 is only as tight as the group membership.
Shared executables a team runs and maintains. A script several admins both run and edit, but that should stay invisible to other tenants or low-privilege accounts on a shared machine. Owner and group get full control; others are shut out entirely.
Private group data that isn't quite a secret. Where 660 fits a shared data file, 770 fits the directory holding it (directories need the execute bit to be entered). 770 + 660 inside is the standard group-private layout.

Common mistakes & gotchas

770 is only as safe as the group is small. Every member of the owning group gets full write and execute. If the group is something broad like users or staff, you've effectively opened it to most of the machine. Audit group membership before trusting 770.
It does NOT lock out root. Like every permission mode, 770 is irrelevant to the root user, who can always read, write, and traverse. Don't treat it as protection against an administrator — only against ordinary non-group accounts.
Set the group ownership and the setgid bit, or the protection drifts. A 770 directory only helps if its group is the right one. On collaborative dirs add the setgid bit (2770 / chmod g+s) so new files inherit the directory's group instead of each creator's primary group — otherwise teammates lose access to each other's files.
The group write bit lets any member delete others' files. Inside a 770 directory, write permission means any group member can remove or rename files they didn't create. For shared writable dirs where that's a risk, add the sticky bit (3770) so only owners can delete their own files.

770 vs the alternatives

750 (rwxr-x---) is the read-only-group sibling: the group can enter and run but not write. Choose 750 when the team should use a directory or script but only the owner should change its contents; choose 770 when the team genuinely needs to write.
775 (rwxrwxr-x) is 770 plus read+execute for others — use it when the group writes but the wider world (or the web server) still needs to read and traverse. 770 is the choice when others must be shut out completely.
700 (rwx------) drops the group entirely, leaving only the owner. Step down to 700 when a directory or script is truly personal; use 770 the moment a trusted group must share it.

Set it with chmod

Apply this permission to a single file:

chmod 770 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 770 directory/

The same thing in symbolic form:

chmod u=rwx,g=rwx,o= filename

Frequently asked questions

What does chmod 770 mean?

chmod 770 sets rwxrwx---: the owner and the group can read, write, and execute; all other users get no access at all. It's the standard mode for group-private directories and shared tools.

Is chmod 770 safe?

It's reasonably safe for group collaboration as long as the owning group is small and trusted — others are fully locked out. The risk lives in group membership: a broad group makes 770 nearly as open as world access.

What's the difference between 770 and 750?

770 (rwxrwx---) gives the group write access; 750 (rwxr-x---) gives the group read and execute but not write. Use 770 when the team must create or edit files, 750 when they should only read and run.

Why use the setgid bit with a 770 directory?

Setgid (2770) makes new files and subdirectories inherit the directory's group rather than the creator's primary group. Without it, files a teammate creates may carry the wrong group and become inaccessible to the rest of the team.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 770 — what rwxrwx--- means

Permission breakdown