chmod 440 (r--r-----)

Q: How do I make sure the right users can read a 440 file?

Set the file's group with chown owner:group file so it matches the group whose members need read access, then confirm membership with getent group groupname . Only owner and members of that group can read a 440 file.

Owner and group can read only; nobody can write or execute; others have no access.

Note: this grants group or shared write access — fine for team directories, but make sure that is what you intend.

When to use 440

Secrets shared across a service group, not a single user. 440 (r--r-----) lets the owner and the file's group read, while others get nothing. It fits a credential or config that several daemons running under a shared group must read — e.g. a database password file owned by root:dbusers so every database process can read it but no other account on the box can.
Read-only configuration for a deploy or app group. A settings file or token that a team's service accounts (all in one group) need to read but never modify — 440 grants group read while freezing writes for everyone, including the owner, guarding against accidental edits.
Sudoers-style files and privileged read-only data. Files under /etc that a specific group must consult but absolutely must not rewrite (and that should stay invisible to ordinary users) are natural 440 candidates, often paired with careful chown user:group.
Certificates readable by a service group. A TLS key or CA bundle owned by root:tls set to 440 lets every member of the TLS group read it for serving traffic while keeping it secret from unrelated users and immutable in place.

Common mistakes & gotchas

The group membership is doing the real work — verify it. 440's value depends entirely on which group owns the file. If the readers aren't actually in that group, they get nothing; if the wrong users are in it, they can read your secret. Always pair 440 with a deliberate chown owner:group and check getent group.
No write for the owner, so updates need an unlock step. Like 400 and 444, 440 strips the owner's write bit. Rotating the secret means chmod u+w, edit, then back to 440 — a frequent source of "why can't I save my own file" confusion.
It is not for files that need to be executed. 440 has no execute bit, so a script or binary set to 440 can be read by the group but not run. If group members must execute it, use 550 (r-xr-x---) instead.
Group read is broader than it looks on shared systems. Anyone added to the owning group — now or later — can read a 440 file. On a multi-tenant box, keep the group tight; if only one account should ever read the secret, drop to 400 so no group exposure exists at all.

440 vs the alternatives

400 (r--------) restricts the read to the owner alone, with no group access. Use 400 when exactly one account should see the secret; step up to 440 only when a whole service group genuinely needs read access.
640 (rw-r-----) is 440 plus owner write — the common default for group-readable config the owner still maintains, like a web app's .env owned by app:www-data. Use 640 for files you edit; use 440 to additionally freeze the file against accidental owner writes.
550 (r-xr-x---) adds execute for owner and group. Choose 550 when the owner+group asset is a script or binary that must be runnable; keep 440 for plain data and secrets that should only be read.

Set it with chmod

Apply this permission to a single file:

chmod 440 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 440 directory/

The same thing in symbolic form:

chmod u=r,g=r,o= filename

Frequently asked questions

What does chmod 440 mean?

chmod 440 sets permissions to r--r-----: the owner and the file's group can read it, while everyone else gets no access. No one can write or execute. It is used for group-readable secrets and read-only shared configs.

When should I use 440 instead of 400?

Use 440 when more than one account needs to read the file and those accounts share a group — for example several services reading one credential. Use 400 when only a single owner account should ever read it.

What is the difference between 440 and 640?

640 lets the owner write the file; 440 removes write for everyone, including the owner. Choose 640 for group-readable config you still edit, and 440 when you also want to protect the file from accidental modification.

How do I make sure the right users can read a 440 file?

Set the file's group with chown owner:group file so it matches the group whose members need read access, then confirm membership with getent group groupname. Only owner and members of that group can read a 440 file.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 440 — what r--r----- means

Permission breakdown