chmod 440 Permission Explained: Read-Only for Owner and Group
Summary: Owner and group can read; nobody writes.
| Class | Read (4) | Write (2) | Execute (1) | Octal |
|---|---|---|---|---|
| Owner (u) | 4 | |||
| Group (g) | 4 | |||
| Others (o) | 0 |
chmod 440 filename
chmod 440 Breakdown
| Class | Digit | Symbolic | On a file | On a directory |
|---|---|---|---|---|
| Owner (u) | 4 |
r-- |
Read only | Can list names, but not enter |
| Group (g) | 4 |
r-- |
Read only | Can list names, but not enter |
| Others (o) | 0 |
--- |
No access | Cannot list, enter, or modify |
Is chmod 440 Safe?
Low Risk
- Even the owner cannot modify this file without changing permissions first.
When not to use it
- Files that standard users must write to during normal application runtime
Common Use Cases
- The /etc/sudoers file defining administrative privilege delegations
- Sensitive CMS settings like wp-config.php on managed servers
chmod 440 Command Examples
# Apply using octal mode
chmod 440 filename
# Apply using equivalent symbolic mode
chmod u=r,g=r,o= filename
# Recursive command warning:
chmod -R 440 /path/to/dir
# Note: -R applies the same mode to files and directories. Use find to treat them separately:
find /path/to/dir -type f -exec chmod 440 {} +
# Verify permissions
stat -c '%a %A %n' filename # Linux
stat -f '%Lp %Sp %N' filename # macOS
# Example ls -l output:
-r--r----- 1 alice staff 1024 Jan 15 10:00 example.txtumask Relationship
A umask of 337 makes new directories 440 and new files 440. Test umask values with our interactive Umask Calculator.
Frequently Asked Questions
What does chmod 440 mean?
Owner and group can read; nobody writes. In octal notation, the owner receives 4 (read), the group receives 4 (read), and others receive 0 (no access).
Is chmod 440 safe?
chmod 440 is classified as Low Risk. Even the owner cannot modify this file without changing permissions first.
What is chmod 440 in symbolic notation?
In symbolic notation, chmod 440 is represented as r--r-----. You can apply this permission using the equivalent symbolic command "chmod u=r,g=r,o= filename".
Why is /etc/sudoers 440?
The /etc/sudoers file controls superuser privilege escalation. If arbitrary users could read it, they could map out administrative privileges and search for vulnerabilities. If it were writable, any user could grant themselves root access. Mode 440 restricts read access strictly to root and the admin group while preventing direct editing outside visudo.
Related Permissions
Change one bit: