What chmod 440 grants
The owner and group digits are both 4, granting read permission only. The other-user digit is 0. A regular file appears as -r--r-----: the owner and members of the assigned group can open it, but nobody receives a standard write or execute bit and users outside the group receive no access.
Mode 440 is normally a file permission. A directory with no execute bit cannot be traversed even by a user who can list its names, so private service directories need a separate traversable mode. The parent directories must also allow the service account to reach the file.
Read-only configuration for a service group
A root-owned application configuration can use 440 when the service runs under an account belonging to the file's assigned group. The service gains only the read access needed to load settings, while unrelated users cannot inspect the file and the running service cannot rewrite it through ordinary permissions.
This pattern is useful for database credentials, signing configuration, or connection settings shared by a small operational group. Keep that group narrowly scoped, verify supplementary group membership for the service process, and restart the process when required so it receives updated membership.
440 compared with 400
chmod 400 allows only the owner to read. Mode 440 adds read access for the assigned group, making it suitable when a service account differs from the administrative owner. If no group member needs the file, 400 provides the narrower access boundary.
Group read permission can disclose every secret in the file to every group member. Do not use a broad convenience group merely because one process needs access. Create or reuse a purpose-specific service group and audit its membership before relying on the middle 4.
440 compared with 640 and 644
Mode 640 adds owner write permission, allowing an administrator or deployment process that owns the file to edit it in place. Mode 440 is more appropriate for an installed configuration that should remain unchanged between controlled deployments. The owner can still change the mode, so this is operational protection rather than immutability.
chmod 644 makes the file readable by every local user. That may fit non-secret configuration, but it is too broad for credentials or internal settings. Choose 440 when a defined service group needs access and everyone outside that group should be excluded.