No, root can still run chmod, because its superuser privileges override the new restrictive directory perms. That was my point. Maybe the original problem was

No, root can still run chmod, because its superuser privileges override the new restrictive directory perms. That was my point. Maybe the original problem was actually "chmod a-rwx /bin/chmod" ... That would mean even the superuser couldn't execute /bin/chmod anymore, so you'd have to do something more creative to reset the executable bit on /bin/chmod. Like compile a C program that calls the chmod system call, or: mv /bin/chmod /bin/chmod.orig cp -p /bin/ls /bin/chmod cp /bin/chmod.orig /bin/chmod