chmod 555: Read and Execute With No Write for Anyone

555 is 755 with the owner's write bit removed. The practical effect is that an editor cannot save over the file and a script cannot overwrite it without first changing the mode. On a directory it means nobody can create, rename or delete an entry, so the set of names inside is frozen while the contents of each file follow their own modes.

That makes it useful as a guard rail. Mount points that should stay empty, vendor supplied trees that a package manager owns, and directories that a deployment must never write into are all reasonable candidates. It converts a class of silent mistakes into an immediate and obvious permission denied.

It is not immutability. The owner and root can run chmod at any time, because the right to change a mode comes from ownership, not from the mode itself. Real immutability on Linux is the file attribute set with chattr +i, which even root must clear before writing, or a read only mount, which applies to the whole file system.

The friction shows up in ordinary tooling. Many editors refuse to save and offer to force, git checkout can fail to overwrite a 555 file, and rm asks for confirmation before removing a write protected file even though the removal itself is permitted by the directory. That last one surprises people: deleting a file is governed by write permission on its directory, not on the file.

Its restrictive sibling is 550, which keeps read and execute for the owner and the group and refuses everything to others. Choose 555 when the content is genuinely public on the machine, and 550 when only a specific service group should be able to run or read it.