Only read access for 'hdfs' and 'yarn' system users are needed. Default permissions are root:hadoop owner, 0644 mode.
Of course you need also dfs.hosts, yarn.resourcemanager.nodes.include-path properties (default values are empty, which means permit every host to be a worker node). And dfs.hosts.exclude, yarn.resourcemanager.nodes.exclude-path for the excludes.
The content can be hostnames or the network addresses.