chmod 640: Configuration Files a Service Group Can Read

640 answers a specific question: how does one service read a secret without every account on the machine reading it too. The file is owned by the account that manages it, the group is the service's group, and the group gets read only. The service can start; a shell user outside that group gets permission denied even with the full path.

It is the mode you will find on a lot of system files that carry credentials or sensitive detail. Log files under /var/log are commonly root:adm at 640 so that members of the adm group can read them without being root, and several packaged database and web server configuration files ship the same way for the same reason.

The group read bit rather than group write is the point. The service needs to read the configuration, not to rewrite it, so giving it write permission would let a compromised service modify its own configuration and persist. 640 keeps the write capability with the account or process that legitimately deploys the file.

Its partner directory mode is 750. A 640 file inside a 755 directory is still private in the sense that only the group can read it, but the directory listing reveals its name and size to everyone; a 750 directory hides even that. Pairing 750 directories with 640 files gives a tree where nothing outside the group learns anything.

For a secret only the owner needs, drop the group entirely and use 600. The choice between 600 and 640 is exactly the question of whether some other account has to read this file, and answering it deliberately is what stops environment files ending up at 644 by default.