You run chmod 000 on a file. Can root still read it?
Short answer
Yes. File mode bits are discretionary access control for unprivileged processes. The capabilities(7) man page says privileged processes bypass all kernel permission checks, and CAP_DAC_OVERRIDE specifically bypasses file read, write, and execute permission checks. So chmod 000 will stop an ordinary user but not root, or any process holding that capability. To protect a secret from root-level access you need encryption or isolation, not mode bits.
Permission bits feel absolute: --------- looks like a locked door. For root, it is not.
What the kernel does
Linux file modes are discretionary access control checks applied to unprivileged processes. The capabilities(7) man page states that privileged processes bypass all kernel permission checks, while unprivileged ones face full checks by effective UID, GID, and supplementary groups. Capabilities split that root power into units, and CAP_DAC_OVERRIDE is documented as bypassing file read, write, and execute permission checks. CAP_DAC_READ_SEARCH bypasses read checks on files and read and execute checks on directories.
Security consequences
chmod 000is not protection against a root-level attacker or a process that holds those capabilities.- Secrets that must resist root need encryption (with keys held elsewhere) or separation, not mode bits.
- Granting a service CAP_DAC_OVERRIDE is almost as powerful as root for file access — a least-privilege review should flag it.
Why the distractors fail
Mode 000 does not block root. Taking ownership with chown is unnecessary, since root already bypasses the check. The sticky bit governs deletion in shared directories and has nothing to do with reading this file.
What interviewers want
"Yes — permissions restrain normal users, not privileged processes," and the capability name as a bonus.
Likely follow-ups
- Which capability would let a service read any file without being full root?
- How do immutable attributes (chattr +i) differ from mode bits against root?
- Why does this matter when a web server process is compromised under a root account?