chmod 007: Everyone Else Gets Everything, the Owner Gets Nothing

007 inverts the usual arrangement completely. The account that owns the file cannot read it, the group cannot read it, and every other account on the machine can read it, rewrite it and run it. It combines the maximum exposure of 777 with the practical uselessness of 000 for the person who is supposed to be using the file.

It nearly always comes from a transposition. 700 is the private directory mode, and typing the digits in the wrong order produces this. Because the person who made the mistake immediately cannot read the file, the error is usually discovered within seconds, which is the only merciful thing about it.

The way out is worth understanding. The owner runs chmod and it works, despite having no permission bits at all, because the authority to change a mode comes from ownership rather than from the mode. The same is true of chown restrictions and of deletion: an owner who cannot read a file can still change its mode, and anyone with write permission on the parent directory can still delete it.

While it is set, the exposure is complete. Any account, including a service account that some unrelated compromised process is running under, can modify the contents. If the file is a script that something privileged runs later, that is a straightforward escalation path, and the owner cannot even inspect the file to notice.

There is no legitimate use. Unlike 070, which at least demonstrates the class matching rule, 007 has no teaching value beyond showing that the owner is never locked out of chmod. Fix it to whatever was intended, which is 700 in the overwhelming majority of cases.