The Principle of Least Privilege: Why File Permissions Like 600/644/755 Exist
Anyone who has worked with SSH private keys has run into an instruction to "set it to 600." Config files, by contrast, often get 644, and executable scripts get 755. What do these three-digit numbers actually mean, and why does the right number depend on what kind of file you're dealing with? This post starts from the mechanics of Unix-style (Mac/Linux) file permissions and works up to the design…
File permissions like 600, 644, and 755 refer to three-digit numeric representations of Unix-style file access rights. These numbers break down into who (owner, group, and others) and what permissions (read, write, and execute). Each cell in the 3x3 grid either grants or denies access, which is represented as a single digit in the numeric notation.
The digits correspond to the values of read (4), write (2), and execute (1), with the sum of the granted permissions determining the final number. For example, 644 means the owner has read and write access, while group and others have only read access. The principle behind these permissions is to grant the minimum level of access required for a file or script to function correctly, known as the principle of least privilege.
This reduces the potential damage if a user's account is compromised or an error occurs. For instance, private keys should have permissions of 600, allowing only the owner to read and write to them, while ordinary configuration files can have permissions of 644, providing read access to the group and others but not write access.
Configurable scripts typically have permissions of 755, allowing anyone to execute them while restricting write access to the file owner.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
