What permissions should wallet.dat have to be as secure as possible and still work? I would like to restrict the permissions on my wallet.dat file but but I don't want to stop the bitcoind daemon from functioning. 

What are the bear minimum permissions that need to be on wallet.dat to make it functional, while making it as secure as possible?
The bare minimum permission would be to have it owned, and only accessible to, a user you specially create for bitcoind. At least for creation, and addition of new addresses for change, it will need to be not only readable but also writable. I am not sure if you can make it non-writable for as long as you have not exhausted the unused addresses in it.