chmod 444
chmod 444 sets r--r--r--: the owner, the group and everyone else can read the file, and no one can modify or execute it.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | No | No | 4 |
| Group (g) | Yes | No | No | 4 |
| Others (o) | Yes | No | No | 4 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read the contents | List names only; cannot enter or open entries |
| Group (g) | Read the contents | List names only; cannot enter or open entries |
| Others (o) | Read the contents | List names only; cannot enter or open entries |
Facts
| Octal | 444 (0444) |
|---|---|
| Symbolic | r--r--r-- |
| ls -l, file | -r--r--r-- |
| ls -l, directory | dr--r--r-- |
| Equivalent symbolic command | chmod a=r |
| Default umask that creates it | None of the common umasks; set it explicitly with chmod |
| How Git records a file with it | 100644 (not executable) |
| Special bits | None |
When to use it
- Content that must never change after it is written. Git stores its loose objects in .git/objects as -r--r--r--, since an object whose content changed would no longer match its hash.
- Reference files you want to protect from your own accidental edits: most editors open them read-only or warn before writing.
When not to use it
- As protection against deletion: rm only needs write permission on the directory. It asks "remove write-protected regular file?" and then deletes it if you confirm; rm -f does not even ask.
- Files containing secrets: every account can read them. Use 400 or 440.
Commands
chmod 444 LICENSE
chmod a=r LICENSE # same resultstat -c '%a %A %n' LICENSE # Linux (GNU stat): 444 -r--r--r--
stat -f '%Lp %Sp %N' LICENSE # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 555 and files to 444 separately:
find . -type d -exec chmod 555 {} +
find . -type f -exec chmod 444 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R a=rX ..
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100644; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 444 mean?
- Owner 4, group 4, others 4: read only, r--r--r--.
- How do I edit a file with 444 permissions?
- If you own it, run chmod u+w file (or chmod 644), edit, and optionally set it back. Otherwise you need the owner or root.
- Does 444 make a file immutable?
- No. The owner can change the mode, root ignores it, and anyone with write access to the directory can delete or replace the file. For real immutability on Linux use chattr +i as root.
Last reviewed by Arielton Oberek.