Preventing Bad Permissions: VS Code Copilot and chmod 777

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Describe the task

VS Code Copilot is troubleshooting a permission error on a config directory. To unblock the task quickly, it applies world-writable permissions:

chmod 777 /etc/app/config

SSG blocks this before it runs — world-writable configs allow any local user to modify service configuration.

# illustrative sample output
[BLOCK] bash › chmod 777 /etc/app/config — rule: no-chmod-777

Give SSG context

SSG evaluates VS Code Copilot's shell commands via the SSG MCP Server integration.

Required context

rule no-chmod-777 {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command STARTS_WITH "chmod"
  AND command CONTAINS "777"
  MESSAGE "chmod 777 is blocked. Use the minimum permission set needed (e.g. 644, 755)."
}

Optional context

Also block 666 (world-writable files without execute):

rule no-chmod-666 {
  enabled true
  priority 90
  severity error
  DENY execution
  IF command STARTS_WITH "chmod"
  AND command CONTAINS "666"
  MESSAGE "chmod 666 creates world-writable files. Use 644 for standard file permissions."
}

What SSG does

SSG checks the chmod command before it reaches the shell. The file permissions remain unchanged — no privilege escalation path is opened.

Ask the agent to use minimum permissions

chmod 777 was blocked. Use the minimum permissions required:
  chmod 644 file     # owner read/write, others read-only
  chmod 755 dir      # owner full, others read+execute
  chmod 600 secrets  # owner read/write only (for private keys)
Avoid 777 — it allows any user on the system to modify the target.

How your rule handles octal variations

The rule matches both chmod 777 and chmod 0777. To also catch symbolic forms like chmod a+w, add a second rule:

rule no-chmod-world-write {
  enabled true
  priority 95
  severity error
  DENY execution
  IF command STARTS_WITH "chmod"
  AND command CONTAINS "a+w"
  MESSAGE "Adding world-write permission is blocked."
}

Check permissions with ls -la

Before applying any chmod, use ls -la to understand current permissions and determine the minimal change needed rather than defaulting to 777.