diff --git a/pkg/gen/gen.go b/pkg/gen/gen.go
index 145fd4e..a3d395c 100644
--- a/pkg/gen/gen.go
+++ b/pkg/gen/gen.go
@@ -107,7 +107,7 @@
 
 	filename := filepath.Join(genFile)
 
-	if err := ioutil.WriteFile(filename, b, 0644); err != nil {
+	if err := ioutil.WriteFile(filename, b, 0666); err != nil {
 		log.Fatal(err)
 	}
 }
diff --git a/pkg/tool/file/doc.go b/pkg/tool/file/doc.go
index 1bb0c1c..10fb0b8 100644
--- a/pkg/tool/file/doc.go
+++ b/pkg/tool/file/doc.go
@@ -31,7 +31,7 @@
 //     	filename: !=""
 //
 //     	// permissions defines the permissions to use if the file does not yet exist.
-//     	permissions: int | *0o644
+//     	permissions: int | *0o666
 //
 //     	// contents specifies the bytes to be written.
 //     	contents: bytes | string
@@ -48,7 +48,7 @@
 //     	filename: !=""
 //
 //     	// permissions defines the permissions to use if the file does not yet exist.
-//     	permissions: int | *0o644
+//     	permissions: int | *0o666
 //
 //     	// contents specifies the bytes to be written.
 //     	contents: bytes | string
diff --git a/pkg/tool/file/file.cue b/pkg/tool/file/file.cue
index 8c1767d..a17de08 100644
--- a/pkg/tool/file/file.cue
+++ b/pkg/tool/file/file.cue
@@ -1,11 +1,11 @@
 // Copyright 2018 The CUE Authors
-// 
+//
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// 
+//
 //     http://www.apache.org/licenses/LICENSE-2.0
-// 
+//
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -41,7 +41,7 @@
 	filename: !=""
 
 	// permissions defines the permissions to use if the file does not yet exist.
-	permissions: int | *0o644
+	permissions: int | *0o666
 
 	// contents specifies the bytes to be written.
 	contents: bytes | string
@@ -58,7 +58,7 @@
 	filename: !=""
 
 	// permissions defines the permissions to use if the file does not yet exist.
-	permissions: int | *0o644
+	permissions: int | *0o666
 
 	// contents specifies the bytes to be written.
 	contents: bytes | string
diff --git a/pkg/tool/file/pkg.go b/pkg/tool/file/pkg.go
index 35bcf4d..c4834e7 100644
--- a/pkg/tool/file/pkg.go
+++ b/pkg/tool/file/pkg.go
@@ -27,13 +27,13 @@
 	Append: {
 		$id:         "tool/file.Append"
 		filename:    !=""
-		permissions: int | *420
+		permissions: int | *438
 		contents:    bytes | string
 	}
 	Create: {
 		$id:         "tool/file.Create"
 		filename:    !=""
-		permissions: int | *420
+		permissions: int | *438
 		contents:    bytes | string
 	}
 	Glob: {