Skip to content
Webmaster Tools
Dev utilitiesChmod Calculator444 (r--r--r--)

chmod 444 (r--r--r--)

chmod 444 makes a file read-only for the owner, the group and everyone else. What r--r--r-- means, what it doesn't stop (like deleting), and when to use it.

Command
chmod 444 file
Open in the chmod calculator

What it means

chmod 444 lets everyone read the file, and nobody write to it or run it. That includes the owner. In ls -l it shows as -r--r--r--.

Who Digit Read Write Execute Symbolic
Owner (u) 4 yes no no r--
Group (g) 4 yes no no r--
Others (o) 4 yes no no r--

The symbolic equivalent sets all three classes at once:

chmod a=r notes.txt

On a file

Any user on the system can read the file. Nobody can write to it through normal permissions. The owner can still run chmod to make it writable again, and root can write to it regardless, so 444 is a guard against accidents, not a lock.

It also does not stop anyone from deleting or replacing the file. Removing a file needs write and execute on the directory, not on the file. Some editors and tools that "save" by writing a new copy and renaming it over the old one can therefore replace a 444 file when the directory allows it.

On a directory

444 on a directory is broken in practice. Users can list the names inside, but without execute (x) they can't cd into it or open any file in it. For a public read-only directory use chmod 555 (r-xr-xr-x), or chmod 755 if the owner should still be able to add files.

Typical uses

  • Reference data and published files that should never change once written: release checksums, archived logs, a generated robots.txt you don't want a script to overwrite.
  • Protecting files from your own tools. Some build or deploy steps skip read-only files or fail loudly on them, which is a useful signal.
  • Shared config on a multi-user machine that every user should read and no one should edit without sudo.

Don't use 444 for secrets. Every local user, including the accounts that run your web server and other services, can read it. Use chmod 600 or chmod 400 for anything private.

Read-only versus immutable

If you need a file that even the owner can't remove, permissions aren't enough. On Linux filesystems that support it, root can set the immutable attribute:

sudo chattr +i /etc/resolv.conf
lsattr /etc/resolv.conf
sudo chattr -i /etc/resolv.conf   # undo

An immutable file can't be modified, deleted, renamed or linked, even by root, until the flag is removed. Use it sparingly, since it surprises package managers and other admins.

Recursive pitfalls

chmod -R 444 dir removes execute from every directory in the tree, so nobody, including you, can get into it afterward. Change files only:

find dir -type f -exec chmod 444 {} +

Then leave directories at 755 (or 555 if they should also be read-only).

Web servers

A web server only needs read access to serve static files, so 444 works for them, but chmod 644 is the usual choice: same read access for the server, and the owner can still deploy updates without changing modes first.

  • chmod 644: owner can also write. The default for most files.
  • chmod 400: read-only for the owner only.
  • chmod 666: read and write for everyone, the opposite risk.

Work out any other mode in the chmod calculator.