chmod 400 Permission Explained: Owner Read-Only
Summary: Only the owner can read; nobody writes.
| Class | Read (4) | Write (2) | Execute (1) | Octal |
|---|---|---|---|---|
| Owner (u) | 4 | |||
| Group (g) | 0 | |||
| Others (o) | 0 |
chmod 400 filename
chmod 400 Breakdown
| Class | Digit | Symbolic | On a file | On a directory |
|---|---|---|---|---|
| Owner (u) | 4 |
r-- |
Read only | Can list names, but not enter |
| Group (g) | 0 |
--- |
No access | Cannot list, enter, or modify |
| Others (o) | 0 |
--- |
No access | Cannot list, enter, or modify |
Is chmod 400 Safe?
Restrictive
- Even the owner cannot modify this file without changing permissions first.
When not to use it
- Daily configuration files or scripts that need regular modifications
Common Use Cases
- AWS EC2 SSH private key pairs (.pem files)
- Immutable archive copies of encryption certificates and master secrets
chmod 400 Command Examples
# Apply using octal mode
chmod 400 filename
# Apply using equivalent symbolic mode
chmod u=r,g=,o= filename
# Recursive command warning:
chmod -R 400 /path/to/dir
# Note: -R applies the same mode to files and directories. Use find to treat them separately:
find /path/to/dir -type f -exec chmod 400 {} +
# Verify permissions
stat -c '%a %A %n' filename # Linux
stat -f '%Lp %Sp %N' filename # macOS
# Example ls -l output:
-r-------- 1 alice staff 1024 Jan 15 10:00 example.txtumask Relationship
A umask of 377 makes new directories 400 and new files 400. Test umask values with our interactive Umask Calculator.
Frequently Asked Questions
What does chmod 400 mean?
Only the owner can read; nobody writes. In octal notation, the owner receives 4 (read), the group receives 0 (no access), and others receive 0 (no access).
Is chmod 400 safe?
chmod 400 is classified as Restrictive. Even the owner cannot modify this file without changing permissions first.
What is chmod 400 in symbolic notation?
In symbolic notation, chmod 400 is represented as r--------. You can apply this permission using the equivalent symbolic command "chmod u=r,g=,o= filename".
Why does AWS require chmod 400 for .pem files?
Amazon Web Services mandates chmod 400 for EC2 private key (.pem) files so that only the file owner can read the key and neither the owner nor anyone else can accidentally overwrite it. When you connect via OpenSSH, the client checks key permissions and immediately terminates the connection if permissions are looser than 400 or 600.
Related Permissions
Change one bit:
Often compared: chmod 600 vs 400