chmod 444 — what does it mean?
444 is 644 with the owner's write bit removed. It signals 'this file is not meant to be edited' to people and tools: editors open it read-only, rm asks before deleting it, and scripts that try to write to it fail loudly. It is a speed bump rather than a lock, because the owner can always restore write with chmod, and deleting or replacing the file depends on the directory's permissions, not the file's.
444
r--r--r--
Everyone, including the owner, can read the file; nobody can write to it or execute it without first changing its mode.
Symbolic equivalent: chmod u=r,g=r,o=r schema.sql
What each digit in 444 means
Each octal digit is the sum of read (4), write (2) and execute (1) for one class of users. The digits are, in order, the file's owner, the file's group, and everyone else.
| Class | Digit | Sum | r w x | ls -l |
|---|---|---|---|---|
| Owner (u) | 4 | 4 + 0 + 0 | r-- | r-- |
| Group (g) | 4 | 4 + 0 + 0 | r-- | r-- |
| Others (o) | 4 | 4 + 0 + 0 | r-- | r-- |
- Owner: can read the contents; no write or execute.
- Group: can read the contents; no write or execute.
- Others: can read the contents; no write or execute.
When to use chmod 444
- Generated files that should only be changed by regenerating them, such as lockfiles or compiled output in a shared checkout.
- Reference data, released migration files or published artifacts you never want edited in place.
- Files in a read-only bundle or package cache, which some package managers create as 444 to discourage edits (Go module cache files, for example).
Security risks and gotchas
Owner and root can bypass it
The owner can chmod u+w at any time, and vim's :w! will happily rewrite a read-only file you own. Root ignores permission bits. Use chattr +i or a read-only mount for real protection.
Anyone can read it
444 is world-readable. If you want a secret that nobody can accidentally overwrite, use 400 or 440, not 444.
Cleanup scripts may fail
rm -r prompts for every write-protected file and some build tools fail to delete read-only files (notably on Windows mounts). Use rm -rf or chmod -R u+w before deleting a directory full of 444 files, which is a known chore with the Go module cache.
chmod -R u+w ./build && rm -rf ./buildCommands
Make a file read-only for everyone
chmod 444 schema.sqlEquivalent to chmod a=r schema.sql.
Remove write for everyone, keep the rest
chmod a-w schema.sqlTurns 644 into 444 and 755 into 555, preserving execute where it exists.
Make it editable again
chmod u+w schema.sqlRestores the owner's write bit (444 becomes 644).
How to check for 444
# Symbolic view
ls -l schema.sql
-r--r--r-- 1 deploy deploy 9310 Oct 16 09:12 schema.sql
# Octal view (Linux / GNU coreutils)
stat -c '%a %A %n' schema.sql
444 -r--r--r-- schema.sql
# Octal view (macOS / BSD)
stat -f '%Lp %Sp %N' schema.sqlThe first character of the ls -l output is the file type (- regular file, d directory), followed by the nine permission characters. stat -c %a prints the octal mode directly; it only shows a fourth leading digit when setuid, setgid or the sticky bit is set.
Related chmod modes
400r--------
Owner read-only
644rw-r--r--
Owner read and write, everyone else read-only
640rw-r-----
Owner read and write, group read, others none
755rwxr-xr-x
Owner full access, everyone else read and execute
Try variations of 444 in the chmod calculator, browse all chmod modes, or read Linux file permissions explained for chown, umask and ACLs.
Frequently Asked Questions
What is the difference between chmod 444 and chmod 400?▾
444 lets everyone read the file; 400 lets only the owner read it. Neither allows writing. Use 400 for secrets and 444 for public files you want protected from edits.
Can the owner edit a 444 file?▾
Not directly, but the owner can change the mode back with chmod u+w, and some editors do that for you when you force a save. 444 prevents accidents, not deliberate changes.
Does chmod 444 stop a file from being deleted?▾
No. Deleting a file needs write permission on the directory, not on the file. rm will prompt because the file is write-protected, but anyone with write access to the directory can remove it.