chmod 000: No Permissions for Anyone, and What Still Works

000 is the quarantine mode. Setting it on a file takes that file out of service for every unprivileged account at once without deleting it, which is useful when you want to stop something being read or executed while you work out whether it should exist at all. The file, its contents and its timestamps are untouched.

Three things still work afterwards, and all three surprise people. Root reads and writes it regardless, because a privileged process bypasses the permission check entirely. The owner can restore any mode at will, since chmod is authorised by ownership. And the file can still be deleted by anyone with write permission on the containing directory, because removal is a directory operation.

That last point is worth stating plainly: 000 does not protect a file from being removed. If the goal is to stop deletion, the control is the directory mode, or the sticky bit on a shared directory, or the immutable attribute set with chattr +i, which even root must clear first.

On a directory, 000 blocks listing and traversal for everyone unprivileged, which makes the entire subtree unreachable regardless of how open the modes inside are. It is an effective way to shut off a path, and an easy way to break a service in a manner that produces no useful log line anywhere, so record what you did before you walk away from it.

As a permanent state it is a smell. A file nobody can read is either something that should have been removed or something whose access should have been narrowed with an explicit owner and group. Use 000 as a temporary measure, and let the permanent answer be a real mode with a real owner.