diff --git a/deb/debian/postinst.m4 b/deb/debian/postinst.m4
index 8621a7a6..ef0fddb5 100644
--- a/deb/debian/postinst.m4
+++ b/deb/debian/postinst.m4
@@ -286,6 +286,9 @@ ifelse(eval(ifelse(M4_PRODUCT_NAME,documentserver-ee,1,0)||ifelse(M4_PRODUCT_NAM
 		setup_nginx
 
 		# modify permissions for M4_ONLYOFFICE_VALUE files and folders
+		find "$DIR" -type d -exec chmod 555 {} \;
+		find "$DIR" -type f -perm 755 -exec chmod 550 {} \;
+
 		mkdir -p "$LOG_DIR/docservice"
 		mkdir -p "$LOG_DIR-example"
 		mkdir -p "$LOG_DIR/converter"
diff --git a/rpm/common.spec b/rpm/common.spec
index 992acd15..daaad71a 100644
--- a/rpm/common.spec
+++ b/rpm/common.spec
@@ -163,11 +163,28 @@ symlinks -c \
 rm -rf "%{buildroot}"
 
 %files
-%attr(-, ds, ds) %{_localstatedir}/www/%{_ds_prefix}*/*
+%defattr(444, ds, ds, 555)
+%attr(-, ds, ds) %{_localstatedir}/www/%{_ds_prefix}*
+%defattr(644, ds, ds, 755)
+%if %{defined example}
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}-example/example
+%endif
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/npm/json
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/DocService/docservice
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/Metrics/metrics
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/Metrics/node_modules/modern-syslog/build/Release/core.node
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/tools/*
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/SpellChecker/node_modules/nodehun/build/Release/nodehun.node
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/SpellChecker/spellchecker
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/FileConverter/converter
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/FileConverter/bin/docbuilder
+%attr(550, ds, ds) %{_localstatedir}/www/%{_ds_prefix}/server/FileConverter/bin/x2t
+
 %config %attr(440, ds, ds) %{_sysconfdir}/%{_ds_prefix}*/*.json
 %config %attr(440, ds, ds) %{_sysconfdir}/%{_ds_prefix}*/log4js/*.json
 
 %config %attr(-, ds, ds) %{_sysconfdir}/%{_ds_prefix}*/nginx/includes/*
+%dir %attr(-, ds, ds) %{_sysconfdir}/%{_ds_prefix}/nginx
 %config %attr(-, ds, ds) %{_sysconfdir}/%{_ds_prefix}/nginx/*.tmpl
 
 %config(noreplace) %{_sysconfdir}/%{_ds_prefix}/nginx/ds.conf
@@ -175,8 +192,8 @@ rm -rf "%{buildroot}"
 %config %attr(644, root, root) %{_sysconfdir}/%{_ds_prefix}/logrotate/*
 %config %attr(-, ds, ds) %{_sysconfdir}/%{_ds_prefix}*/supervisor*/*
 
-%attr(-, root, root) %{_libdir}/*.so*
-%attr(-, root, root) %{_bindir}/documentserver-*.sh
+%attr(555, root, root) %{_libdir}/*.so*
+%attr(544, root, root) %{_bindir}/documentserver-*.sh
 %attr(-, root, root) %{_sysconfdir}/logrotate.d/*
 %attr(-, root, root) %{_sysconfdir}/nginx/*
 %attr(-, root, root) %{_sysconfdir}/supervisord.d/*