Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have been learning Python and Bash scripting, and I up to now I have given my scripts 777 permissions. Having learned more about how to set permissions, and knowing this is a bad idea, I ran the following command (On Mac OSX, v10.6.8):

find / -type f -perm 0777

I was expecting to only get a small list of files that I had assigned 777 permissions, but instead I got a huge list. (1,503 to be exact.) These include my small number of scripts, as well as all of my image files, html and css files, example code that came with ebooks, as well as files related to applications such as Adobe Flash Catalyst, Smith Micro Anime Studio, something called Microsoft Play Ready (I assume this is part of Silverlight), and others.

I'm kind of new at this, but isn't this a problem? Should any files have 777 permissions?

share|improve this question
    
Files (on Unix file systems) are usually created without execute rights. Thus you probably either have copied them from a VFAT volume or have executed something like chmod -R 777 . in the past. Even a umask of 000 or rwx default ACLs should not cause such files. –  Hauke Laging Mar 16 '13 at 16:02
    
The image files were copied from a windows machine, an NTFS volume, I believe. I have only run chmod 777 on my python and bash scripts. Many of these files seem to have been installed by applications, (adobe, anime studio, etc.) –  John Aten Mar 16 '13 at 16:09
    
Do the files have an ACL? ls -l shows a + after the permissions (e.g. -rwxrwxrwx+) if there is one, and ls -le shows the ACL. –  Gilles Mar 16 '13 at 23:43
    
Note that Soft Links always have permissions of 777. This is not a security risk. –  Johan Mar 17 '13 at 8:22
    
Also note that files copied in from FAT/FAT32 formatted disks often end up with wildly permissive permissions. –  Johan Mar 17 '13 at 8:26

2 Answers 2

up vote 2 down vote accepted

It is really not normal to give files 777 permission. I cannot think of a legitimate reason for any file to have such permission, but if exists, it had better have a really really good reason.

I advise you to change those permissions immediately.

  • At the minimum, remove the write permission of others, with chmod -R o-w
  • Most probably you also want to remove the write permission of the group too, with chmod -R g-w
  • Personally I really don't like seeing image/audio/video/document files with executable bits on. I would remove those too, with something like find /path -name '*.png' -exec chmod a-x {} \;

In the future, be more careful. It is security 101 to not give more permissions than really needed. For example you can start by setting all files to 0400 and all directories to 0500 and then see what is not working and gradually add the bare minimum permissions.

What is the output of umask in your system? If it is more permissive than 0022 then I think you might want to add in your ~/.bashrc the command umask 0022. This has the effect that new files you create will not have write permission for group and others by default.

share|improve this answer
    
umask returns 0022. Thank you for the information. I will follow your recommendations. I am still curious about the files associated with applications, though. Should I check the permissions every time I install something? –  John Aten Mar 16 '13 at 18:23
    
Normally you don't need to check the permissions every time, unless you want to be suspicious. It's strange how those application files got such permissions. –  janos Mar 17 '13 at 7:55
    
Yeah, I was wondering if this hinted at a problem of some kind. –  John Aten Mar 17 '13 at 16:18

permission 777 is not Necessary for all files.

permissions are : rwxrwxrwx , which are three group of "rwx" first for owner user, second for owner group and third for others.

777 is binary of 111 111 111, so: 777 -> rwxrwxrwx

another example : 760 ->rwxrw----

if a file is not executable, it's not Necessary to give it execute permission, like Ebooks.

and if you have an executable program like a bash script,and you don't want to let others execute the script, the third num of the third part must be zero , I mean :??? ??? ??0

for example you want to let others read your script, but you don't let them to write or execute it, so the permission will be : ??? ??? r-- =>??4

share|improve this answer
1  
I understand the basics of permissions. I ran the find command to get a list of files on which I needed to restrict the permissions. My main question is: should any files be allowed to have 777 permissions and if so when/why? Should I change any/all of these files to more restrictive permissions? Also, does this indicate a past problem and/or pose a potential problem? –  John Aten Mar 16 '13 at 16:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.