Owner can read and write. Group can read. Others can do nothing.
| Read | Write | Execute | |
|---|---|---|---|
| Owner | ✓ | ✓ | – |
| Group | ✓ | – | – |
| Others | – | – | – |
Typical use
Config files a service’s group may read.
Good to know
640 (rw-r-----) lets the owner edit, the group read, and others nothing. It is the usual mode for config files with secrets that a service reads: owned by root with the group set to the service, so the daemon can read its password but not change the file. /etc/shadow on Debian and Ubuntu is 640 root:shadow for exactly this reason.
The group is what makes it work: set it with chown root:appgroup file and add the service user to that group. If a service reports “permission denied” on its config, check the group and the x bits on every parent folder with namei -l /path/to/file. Don’t use 640 for SSH private keys: OpenSSH rejects any key the group can read.
Commands
| Set the mode | chmod 640 file |
|---|---|
| The same with letters | chmod u=rw,g=r,o= file |
| A folder and everything in it | chmod -R 640 folder |
| Only the folders inside | find folder -type d -exec chmod 640 {} + |
| How ls -l shows it | -rw-r----- |