chmod 000, 400, 555, 600, 666 and 770: Linux Permissions Guide

Each digit is the sum of read (4), write (2) and execute (1). The three digits apply to owner, group and other, in that order.

digit = 4·r + 2·w + 1·x e.g. rw- = 4 + 2 + 0 = 6, r-x = 4 + 0 + 1 = 5

On a directory the bits mean something slightly different. Read lists the names, write creates and deletes entries, and execute lets you enter the directory and reach files inside it.

chmod 000 sets ---------- and removes every permission for owner, group and others. Only root can still read the file, and the owner can still change the mode back.

Use it to quarantine a suspicious script during an investigation without deleting evidence. The file stays in place with its timestamps, but normal users cannot run or read it.

Do not treat chmod 000 as a security boundary. Root bypasses file permissions, and the owner can run chmod 600 to undo it. See the chmod 000 page for the full bit breakdown.

chmod 400 gives the owner read-only access (r--------) and nobody else any access. It is the standard mode for SSH private keys and AWS .pem key files.

OpenSSH refuses a private key that others can read. You will see WARNING: UNPROTECTED PRIVATE KEY FILE! and the login fails. Setting the key to 400 or 600 fixes it.

chmod 400 ~/.ssh/my-server.pem
chmod 700 ~/.ssh
ssh -i ~/.ssh/my-server.pem ubuntu@203.0.113.10

Choose 400 when the file should never change, and 600 when a tool must rewrite it. The chmod 400 preset shows the symbolic and binary forms.

chmod 555 gives everyone read and execute (r-xr-xr-x) and removes write access for all users, including the owner.

On a script, 555 lets anyone run it while stopping accidental edits. On a directory, nobody except root can create, rename or delete files inside it.

This is useful for shared tool directories and for read-only content in containers. The owner can still restore write access with chmod u+w. Explore it on the chmod 555 page.

chmod 600 gives the owner read and write (rw-------) and nobody else any access. It is the right mode for secrets that a program must update.

Typical files are ~/.ssh/id_ed25519, .env files with API keys, ~/.netrc, and ~/.pgpass. PostgreSQL ignores a .pgpass file that is more permissive than 0600.

Configuration tools write it as "mode 600". In Ansible the parameter is mode: '0600'; quote it, or YAML reads the number in decimal. Open the chmod 600 preset to compare it with 640 and 644.

chmod 600 .env

# Ansible task
- name: Install API secrets
  ansible.builtin.copy:
    src: app.env
    dest: /opt/app/.env
    owner: app
    mode: '0600'

chmod 666 gives every user read and write (rw-rw-rw-). The file is world-writable, so any local account can change it.

Device nodes such as /dev/null are 666 by design. Regular files almost never should be. A world-writable config or script lets any compromised account change what a privileged process reads or runs.

New files start from 666 and the umask removes bits. With the common umask 022, new files become 644. See the chmod 666 page for the audit findings.

Permission 770 (rwxrwx---) gives the owner and the group full access and blocks everyone else. It suits shared team directories.

Pair 770 with the setgid bit on directories so new files inherit the group. Without it, each file takes the creator's primary group and teammates lose access.

sudo groupadd secops
sudo mkdir -p /srv/cases
sudo chown root:secops /srv/cases
sudo chmod 2770 /srv/cases   # 2 = setgid, 770 = rwxrwx---

The permission 770 preset explains each triplet, and the matrix diagram above compares it with 777.

chmod 777 lets every user read, write and execute the file. Any local account or compromised service can then replace its contents.

Web servers are the classic case. A 777 upload directory lets an attacker who gains any foothold drop a web shell that the server then runs. Use 755 for directories and 644 for files, and grant write access to the service user only.

The chmod 777 page flags this mode as critical and suggests safer alternatives.

Use find with -perm to list world-writable files and directories, and stat to print each file's octal mode.

# World-writable regular files (skips /proc and /sys)
find / -xdev -type f -perm -0002 2>/dev/null

# World-writable directories without the sticky bit
find / -xdev -type d -perm -0002 ! -perm -1000 2>/dev/null

# Octal mode and name
stat -c '%a %n' ~/.ssh/*

If a find result shows an encoded or obfuscated script, decode it safely with the Log De-obfuscator before you open it.

Use octal when you want to set an exact final mode, such as 600. Use symbolic mode, such as u+x, when you want to change one bit and leave the rest alone.

Octal replaces the whole mode in one step, so the result is predictable. chmod 640 app.conf always ends with rw-r-----, whatever the file had before.

Symbolic mode edits the current permissions. chmod g-w,o= report.csv removes write from the group and clears every bit for others. It is safer inside scripts that run on files with different starting modes.

New files start at 666 and new directories at 777, and the umask removes bits from those values. A umask of 022 gives files 644 and directories 755.

Check your current value with umask, and set it for a service with UMask=0027 in its systemd unit. A tight umask means fewer files need a chmod afterwards, which removes a whole class of mistakes.