diff --git a/config/file.go b/config/file.go
index 04f12c2..76b5827 100644
--- a/config/file.go
+++ b/config/file.go
@@ -21,5 +21,5 @@ type File struct {
 	Content            string `yaml:"content"`
 	Owner              string `yaml:"owner"`
 	Path               string `yaml:"path"`
-	RawFilePermissions string `yaml:"permissions"`
+	RawFilePermissions string `yaml:"permissions" valid:"^0?[0-7]{3,4}$"`
 }
diff --git a/config/file_test.go b/config/file_test.go
index a1e03e2..e3f0871 100644
--- a/config/file_test.go
+++ b/config/file_test.go
@@ -46,3 +46,26 @@ func TestEncodingValid(t *testing.T) {
 		}
 	}
 }
+
+func TestRawFilePermissionsValid(t *testing.T) {
+	tests := []struct {
+		value string
+
+		isValid bool
+	}{
+		{value: "744", isValid: true},
+		{value: "0744", isValid: true},
+		{value: "1744", isValid: true},
+		{value: "01744", isValid: true},
+		{value: "11744", isValid: false},
+		{value: "rwxr--r--", isValid: false},
+		{value: "800", isValid: false},
+	}
+
+	for _, tt := range tests {
+		isValid := (nil == AssertStructValid(File{RawFilePermissions: tt.value}))
+		if tt.isValid != isValid {
+			t.Errorf("bad assert (%s): want %t, got %t", tt.value, tt.isValid, isValid)
+		}
+	}
+}