DevToolsmith

Chmod 640

chmod 640 sets the permissions to rw-r-----: it lets the owner read and write, the group read, and others nothing. Here is exactly what that allows on files and directories, when to use it, and the commands to apply it.

Runs 100% in your browser — nothing is uploaded

ClassreadwriteexecuteValue
owner6
group4
others0
Common:
$ chmod 640 file.sh
$ chmod u=rw,g=r,o= file.sh
  • • The owner can read and write.
  • • The group can read.
  • • Everyone else can do nothing.

What chmod 640 means

WhoDigitLettersOn a fileOn a directory
owner 6 rw- Can read and modify Can list files (write has no effect without execute)
group 4 r-- Can read Can list files
others 0 --- No access No access

Each digit is the sum of read (4), write (2) and execute (1). In ls -l output it looks like this: 

$ ls -l
-rw-r-----  1 alice  staff  1834 Oct 21 10:30 example.txt
  • The owner can read and write.
  • The group can read.
  • Everyone else can do nothing.

When to use 640

  • Config files with secrets read by a service group
  • Log files
  • TLS private keys with a group like ssl-cert

640 is ideal when a file is owned by root but a service needs to read it, e.g. a database password in /etc/myapp/config.yml owned by root:myapp. On Debian and Ubuntu, many files in /var/log are 640 with group adm, which is why adding a user to adm lets them read logs.

640 is also the default mode for new files, with umask 027.

Is chmod 640 safe?

Yes. Nobody outside the owner and group can access it at all (except root).

Commands

# One file
chmod 640 file

# Same thing in symbolic form
chmod u=rw,g=r,o= file

# Every file under a tree (leaves directories alone)
find /path/to/dir -type f -exec chmod 640 {} +

# Check the result
stat -c '%a %A %n' file    # Linux
stat -f '%Lp %Sp %N' file  # macOS

Avoid chmod -R 640 on a whole tree: it gives files and directories the same mode. The find form above changes only files.

Compare with similar modes

ModeSymbolicDifference
660 rw-rw---- Lets the owner and group read and write, and others nothing
644 rw-r--r-- Lets the owner read and write, and everyone else only read
600 rw------- Lets only the owner read and write

Other chmod values

777 · 775 · 770 · 755 · 751 · 750 · 744 · 711 · 700 · 666 · 664 · 660 · 644 · 600 · 555 · 500 · 444 · 400 · 000 · 1777 · 2775 · 4755

Need a different combination? Use the Chmod Calculator.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does chmod 640 mean?

chmod 640 sets the permissions to rw-r-----. The owner can read and write. The group can read. Everyone else can do nothing.

Is chmod 640 safe?

Yes. Nobody outside the owner and group can access it at all (except root).