chmod 000
chmod 000 sets ---------: the owner, the group and everyone else lose read, write and execute, so only root (which bypasses these checks) can open the file, and only the owner or root can change the mode back.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | No | No | No | 0 |
| Group (g) | No | No | No | 0 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | No access | No access |
| Group (g) | No access | No access |
| Others (o) | No access | No access |
Facts
| Octal | 000 (0000) |
|---|---|
| Symbolic | --------- |
| ls -l, file | ---------- |
| ls -l, directory | d--------- |
| Equivalent symbolic command | chmod a= |
| Default umask that creates it | None of the common umasks; set it explicitly with chmod |
| How Git records a file with it | 100644 (not executable) |
| Special bits | None |
When to use it
- Files only root should ever touch: on Fedora and RHEL, /etc/shadow is ----------, and the tools that update it run as root.
- Quarantining a suspicious upload or disabling a script without deleting it, so nothing running as a normal user can read or run it.
When not to use it
- As protection against root: root still reads and writes it.
- On directories you still need: even the owner can no longer list or enter them until they chmod them back.
- As a way to hide a file: its name, size and owner remain visible to anyone who can list the directory.
Commands
chmod 000 quarantine.bin
chmod a= quarantine.bin # same resultstat -c '%a %A %n' quarantine.bin # Linux (GNU stat): 0 ----------
stat -f '%Lp %Sp %N' quarantine.bin # macOS and BSDApplying it to a whole tree
A recursive chmod -R 000 stops at the first level: once a directory is 000, chmod cannot even look inside it as a normal user. There is rarely a reason to do this; to lock a tree, set 700 on its top directory.
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100644; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 000 do?
- It clears all nine permission bits. Normal users, including the owner, get permission denied; root can still read and write.
- Is chmod 000 the same as chmod 0000?
- On regular files, yes. On directories GNU chmod keeps an existing setuid or setgid bit with 000 or 0000; use five digits (00000) or chmod a-s to clear those too.
- How do I undo chmod 000?
- As the owner, run chmod 644 on a file or chmod 755 on a directory. You do not need read access to a file to change its mode.
Last reviewed by Arielton Oberek.