chmod 400
chmod 400 sets r--------: the owner can read the file and nothing else, and the group and every other account have no access at all.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | No | No | 4 |
| Group (g) | No | No | No | 0 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read the contents | List names only; cannot enter or open entries |
| Group (g) | No access | No access |
| Others (o) | No access | No access |
Facts
| Octal | 400 (0400) |
|---|---|
| Symbolic | r-------- |
| ls -l, file | -r-------- |
| ls -l, directory | dr-------- |
| Equivalent symbolic command | chmod u=r,go= |
| Default umask that creates it | None of the common umasks; set it explicitly with chmod |
| How Git records a file with it | 100644 (not executable) |
| Special bits | None |
When to use it
- SSH private keys downloaded from a cloud provider: the Amazon EC2 guide tells you to run chmod 400 key-pair-name.pem before connecting, because ssh ignores keys others can read.
- Credentials a process reads as its own user and never rewrites, such as wp-config.php when PHP runs as the file owner (WordPress recommends 440 or 400).
When not to use it
- Files you update regularly: every change needs chmod u+w first. For a key you might re-encrypt with ssh-keygen -p, 600 is less friction.
- Files a service reads under another account: it gets permission denied.
Commands
chmod 400 key.pem
chmod u=r,go= key.pem # same resultstat -c '%a %A %n' key.pem # Linux (GNU stat): 400 -r--------
stat -f '%Lp %Sp %N' key.pem # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 500 and files to 400 separately:
find . -type d -exec chmod 500 {} +
find . -type f -exec chmod 400 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R u=rX,go= ..
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100644; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 400 mean?
- Owner 4 (read), group 0, others 0: r--------.
- Why does AWS say chmod 400 for the .pem file?
- ssh refuses a private key that group or others can read, with "Permissions 0644 ... are too open". 400 is owner read-only, which ssh accepts; 600 works as well.
- I get "chmod: Operation not permitted" on my .pem file. Why?
- You are not its owner, or it sits on a filesystem without Unix permissions (a Windows drive under WSL, FAT32, some network shares). Copy it into ~/.ssh and run chmod there.
Last reviewed by Arielton Oberek.