A handful of well-known system files have modes that look surprising on first contact, but each has a clear reason. SSH is the strictest case: the ~/.ssh directory must be 700 and the private key (typically id_ed25519) must be 600, otherwise the SSH client refuses to use the key — a deliberate security check. The matching public key is 644, and authorized_keys is normally 600 as well. These defaults protect the cryptographic material from any user who happens to share the machine.
Password storage follows the same idea. /etc/passwd is world-readable (644) because countless utilities need to map numeric UIDs to usernames; only the password hashes live elsewhere, in /etc/shadow at 640 owned by root:shadow. This split lets the system identify users while keeping the actual secrets locked away. The general rule is that things everyone needs to read stay readable, while secrets get a restrictive mode.
Beyond traditional Unix permissions, two extended attributes provide stronger protection. chattr +i file marks a file as immutable, so even root cannot modify or delete it until chattr -i reverses the bit; root can normally do anything filesystem-wise, but immutable files remain out of reach. chattr +a logfile sets the append-only flag, allowing data to be added to the end of a file but preventing truncation or rewriting — ideal for tamper-evident log files. Both flags can be inspected with lsattr file. When a permission error says "Operation not permitted" on a file the user clearly owns, the immutable attribute, a read-only mount, or a MAC policy such as SELinux or AppArmor is usually the culprit rather than the Unix mode itself.