chmod 550 (r-xr-x---)

Q: Can the group edit a 550 file?

No. The group gets r-x — read and execute but not write. Group members can run the script or read the data, but to modify it they'd need the owner (after restoring write) or root.

Owner and group can read and execute, but nobody can write; others have no access.

Note: this grants group or shared write access — fine for team directories, but make sure that is what you intend.

When to use 550

Shared scripts a team runs but nobody should edit. 550 (r-xr-x---) lets the owner and a designated group read and execute a script while completely shutting out everyone else. Put a deployment or maintenance script under an ops group at 550 so only ops members can run it, and even they can't accidentally modify it.
Group-restricted binaries and tool directories. A directory at 550 can be entered and listed by owner and group but not by others — useful for a /opt/internal-tools tree shared across a team but hidden from general users on a multi-tenant box.
Locked-down executables in a controlled pipeline. When a CI runner or service account belongs to a shared group, 550 gives that group execute access without write — the file stays immutable at runtime, so a compromised process in the group can run it but can't trojan it.
Read-only config or data shared with one group. For a directory of reference data that owner and group must traverse and read but never write, 550 keeps it tamper-proof while still excluding the rest of the system.

Common mistakes & gotchas

Nobody can write — not even the owner. 550 strips the owner's write bit, so editing the file means a chmod u+w first (or editing as root). This is a feature for tamper-resistance, but it surprises people who expect the owner to always be able to save.
Execute on a directory means traverse, not run. 550 on a directory lets owner and group cd into it and access named files; the read bit additionally lets them list contents with ls. On a file, the same bits mean actually executing it. Don't conflate the two meanings.
Others get nothing — including services that need it. The trailing --- means accounts outside the group (often www-data, nobody, or a different service user) get permission denied. If a web server or daemon must read the file, it has to be in the group, or 550 is the wrong mode.
The group matters as much as the bits. 550 is only as tight as its group membership. A file owned by group users at 550 is readable/executable by basically everyone on the box. Set a narrow group with chgrp first, then apply 550.

550 vs the alternatives

750 (rwxr-x---) is the writable sibling of 550 — same group/others story, but the owner keeps write. Choose 750 when the owner still maintains the file; choose 550 to freeze it against accidental edits.
500 (r-x------) drops group access entirely. Use 500 for a purely private script only the owner runs; step up to 550 the moment a trusted group also needs to run it.
555 (r-xr-xr-x) opens read+execute to everyone, including others. Use 555 for world-runnable tools; keep 550 when the rest of the system must be excluded.

Set it with chmod

Apply this permission to a single file:

chmod 550 filename

Or apply it recursively to a directory and everything inside it:

chmod -R 550 directory/

The same thing in symbolic form:

chmod u=rx,g=rx,o= filename

Frequently asked questions

What does chmod 550 mean?

550 sets r-xr-x---: owner gets read and execute, group gets read and execute, others get nothing. No one — not even the owner — has write permission, so the file or directory is read-only and runnable by owner and group only.

Why would I remove the owner's write bit with 550?

To make the file tamper-resistant. With 550 a stray editor save, a buggy script, or a compromised process running as the owner can't overwrite it. When you genuinely need to change it, run chmod u+w file, edit, then chmod 550 file again.

Can the group edit a 550 file?

No. The group gets r-x — read and execute but not write. Group members can run the script or read the data, but to modify it they'd need the owner (after restoring write) or root.

What's the difference between 550 and 750?

Only the owner's write bit. 750 is rwxr-x--- (owner can write), 550 is r-xr-x--- (owner cannot). Use 750 while you still maintain the file, 550 once you want it locked against accidental changes.

Other common permissions

Or build any permission with the interactive chmod calculator.

chmod 550 — what r-xr-x--- means

Permission breakdown