chmod 440: Read Only for Owner and Group, the sudoers Mode

440 is the mode for a policy file: something that decides what is allowed, that several parties may need to read, and that nothing should be able to modify by accident. Removing write from the owner as well as everyone else means an edit has to be a deliberate two step act, which is exactly the behaviour you want around a file that grants privilege.

sudo enforces it. The sudoers file ships as 0440 owned by root, and sudo refuses to run at all if the file is writable by anyone other than the owner, reporting that the mode is wrong and exiting rather than falling back to a permissive default. Files dropped into /etc/sudoers.d are checked the same way and are silently ignored if their mode is loose.

This is why visudo exists. It edits a copy, validates the syntax, and puts the file back with the correct owner and mode, so that a typo or a stray chmod cannot leave you with a machine where sudo will not run and there is no way to fix it without a rescue boot. Editing sudoers directly is the classic way to lock yourself out.

Outside sudo, 440 suits any file a service group must read and nothing should write: a signed policy document, a licence key file, a certificate authority bundle that a deployment installs and applications only consume. Pair it with a 750 directory so that accounts outside the group cannot even see that the file exists.

The difference from 640 is the owner's write bit. 640 expects the owner to update the file as part of normal operation; 440 says updates are exceptional and should require an explicit mode change first. Choose based on how often the file legitimately changes, not on how sensitive it feels.