chmod 640
chmod 640 sets rw-r-----: the owner can read and modify the file, members of its group can read it, and everyone else has no access.
Permission matrix
| Who | Read (4) | Write (2) | Execute (1) | Digit |
|---|---|---|---|---|
| Owner (u) | Yes | Yes | No | 6 |
| Group (g) | Yes | No | No | 4 |
| Others (o) | No | No | No | 0 |
Execute means different things by type. On a file it lets the kernel run it as a program. On a directory it is search permission: entering it (cd) and reaching the files inside by name. Read on a directory only lists names.
| Who | On a file | On a directory |
|---|---|---|
| Owner (u) | Read and modify | List names only; write does nothing without execute |
| Group (g) | Read the contents | List names only; cannot enter or open entries |
| Others (o) | No access | No access |
Facts
| Octal | 640 (0640) |
|---|---|
| Symbolic | rw-r----- |
| ls -l, file | -rw-r----- |
| ls -l, directory | drw-r----- |
| Equivalent symbolic command | chmod u=rw,g=r,o= |
| Default umask that creates it | umask 027 for new files |
| How Git records a file with it | 100644 (not executable) |
| Special bits | None |
When to use it
- Configuration with credentials that a service reads through its group: owner root or deploy, group www-data, mode 640.
- Log files: Debian and Ubuntu write many files in /var/log as 640 with group adm, so admins read them without sudo while normal users cannot.
- Web files where the server reads via its group (WordPress accepts 640 for files). It is what new files get under umask 027.
When not to use it
- When the process reading the file is neither owner nor in the group: it gets permission denied.
- SSH private keys: ssh refuses a key the group can read. Use 600.
- Files the group must update: use 660.
Commands
chmod 640 config.env
chmod u=rw,g=r,o= config.env # same resultstat -c '%a %A %n' config.env # Linux (GNU stat): 640 -rw-r-----
stat -f '%Lp %Sp %N' config.env # macOS and BSDApplying it to a whole tree
chmod -R would put the same mode on files and directories alike. Set directories to 750 and files to 640 separately:
find . -type d -exec chmod 750 {} +
find . -type f -exec chmod 640 {} +Or in one pass with a capital X, which adds execute only to directories and to files that already had it: chmod -R u=rwX,g=rX,o= ..
Git and the execute bit
Git stores only one permission fact per file: 100755 if the owner execute bit is set, 100644 otherwise. A file with this mode is committed as 100644; the group and others bits never reach the repository. On Windows, or where core.fileMode is false, set the bit with git update-index --chmod=+x.
Frequently asked questions
- What does chmod 640 mean?
- Owner 6 (rw-), group 4 (r--), others 0 (---).
- What is the difference between 640 and 644?
- Others. 644 lets every account read the file; 640 limits reading to the owner and the group.
- Should a .env file be 640 or 600?
- 600 if the app runs as the file owner, 640 if the owner is a deploy user and the app reads it through its group.
Last reviewed by Arielton Oberek.