On shared unix hosting, if I have a file sensitive-data.txt and I issue:

chmod 600 sensitive-data.txt

Can root user still read my file? Specifically I'm wondering if it's safe to store my password in mercurial hgrc file.


Decided to use the mecurial keyring extension as it was super easy to setup:

pip install mercurial_keyring

and then add to hgrc:

mercurial_keyring =

However I'm still interested in the answer to this question.

7 Answers 7


Yes, root can:

$ echo Hello you\! > file
$ chmod 600 file
$ ls -l file
-rw------- 1 terdon terdon 11 Feb 27 02:14 file
$ sudo -i
# cat file
Hello you!

In any case, even if root couldn't read your files as root, they can always log in as you without a password:

$ whoami
$ sudo -i
[sudo] password for terdon: 
# whoami 
# su - terdon
$ whoami

So, root can change to any other username using su (or sudo -iu username) and will then be able to do anything at all as though they were you.


Always assume that root (and any other user/process with CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH) can do everything unless an LSM (SELinux, AppArmor or similar) prevents him from doing that.

That means also that you should assume that all your keystrokes can be read. Passwords aren't really safe. If you want a serious level of security then you must use a system which is completely controlled by you (and not even used by anyone else).

  • This is actually my problem with capabilities as they're currently implemented. Since they don't specify targets, you need to have type enforcement that supersedes capabilities (like SELinux) just to keep that from happening. Giving one user CAP_DAC_OVERRIDE gives them in one foul swoop all the privilege they need to override any other security mechanism on the system. CAP_DAC_OVERRIDE is basically CAP_DO_WHATEVER_YOU_WANT.
    – Bratchley
    Mar 14, 2014 at 20:13

Yes root have all the privileges to do anything

Here you can see I have created a Directory name test and touched a file lonston.txt and listed the files

root@system99:/tmp# mkdir test && touch lonston.txt && ls -l
total 4
-rw-r--r-- 1 root root    0 Feb 27 16:35 lonston.txt
drwxr-xr-x 2 root root 4096 Feb 27 16:35 test

Then i have changed the permission of file and Directory to null permission using 000 and listed to see the permission

root@system99:/tmp# chmod 000 lonston.txt && chmod 000 test && ls -l
total 4
---------- 1 root root    0 Feb 27 16:35 lonston.txt
d--------- 2 root root 4096 Feb 27 16:35 test

Then even i can Write to the file and the read the file using cat

root@system99:/tmp# echo "Yes root have all Privileges than other user's, let we see the permission of user's too" > lonston.txt 

root@system99:/tmp# cat lonston.txt 
Yes root have all Privilages than other user's, let we see the permission of user's too

Even i can get into the directory which has d--------- (null) 000 permission, even root have no read or Write Permission.

root@system99:/tmp# cd test/
root@system99:/tmp/test# pwd

Even i can Create the files and folder's after the change of permission from any were

root@system99:/tmp/test# touch /tmp/test/lonston/testdir/babin.txt

root@system99:/tmp/test# ls -l /tmp/test/lonston/testdir/
total 0
-rw-r--r-- 1 root root 0 Feb 27 16:39 babin.txt

Now here we can see Permission with 400

root@system99:/tmp/test# chmod 400 babin.txt

List to see the file permission

root@system99:/tmp/test# ls -l
total 8
-r-------- 1 root root   34 Feb 27 16:42 babin.txt
drwxr-xr-x 3 root root 4096 Feb 27 16:38 lonston

Using vim im i have added 1 line to the file babin.txt

root@system99:/tmp/test# vim babin.txt

But while in vim mode it will notice us W10: Warning: Changing a readonly file But it still Writeable

Now we can cat the file for output

root@system99:/tmp/test# cat babin.txt 
hi this is the write persmission 
this is added while the file have 400 permission

Then i have logout from root user to normal user and listed the file having null permisson what in root too

root@system99:/tmp# exit

Navigate to /tmp Directory

sysadmin@system99:~$ cd /tmp/
sysadmin@system99:/tmp$ ls -l
total 8
---------- 1 root root   88 Feb 27 16:36 lonston.txt
d--------- 2 root root 4096 Feb 27 16:35 test

But while reading the file from normal user we can't

sysadmin@system99:/tmp$ cat lonston.txt 
cat: lonston.txt: Permission denied

sysadmin@system99:/tmp$ cd test/
cat: test/: Permission denied

That's it, Hope you got the power of root User

If you in Normal User, if you need to root privilege we need to use sudo, it will ask sudo password

example :

sysadmin@system99:/tmp$ sudo cat lonston.txt 
[sudo] password for sysadmin: 
Yes root have all Privilages than other user's, let we see the permission of user's too

Sudo user have collabration with root user's Group so what sudo have the root privilege.

To know more about sudo

# man sudoers

Here we can see they have defined as the normal user can have Sudo rights Only fewer lines i have mentioned here.

sysadmin@system99:/tmp$ sudo cat /etc/sudoers

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Totally we can read or edit or Delete the files even root Doesn't have the read permission.

  • 2
    Why does this answer has so few upvotes? It covers almost all cases that can occur with examples.
    – Foo Bar
    May 31, 2014 at 13:50

In traditional Unix, root is all-powerful. In particular, root can read any file, and even snoop at what your programs are doing internally. If the data is really sensitive, keep only encrypted copies around (consider e.g. GNU Privacy guard for this, but read its documentation carefully before), and never decrypt it on a machine not under your complete control.

(Paranoia is wonderful, there never is enough of it ;-)

Seriously, think carefully about the costs the leakage of the data could cause, and thus how much you will be prepared to pay for security. Perfect security is impossible, to get a bit more security the cost starts to increase rapidly. But take care not to fall into the trap of an expensive measure which really doesn't increase security...


It should also be assumed that anyone who might have an opportunity to be in the same room as the hardware can read or write anything they want. If they are very patient, they can eventually understand encrypted data. They do not need side-channel methods if they can replace the encryption software.


Yes, the root can read protected file even when the owner cannot (while the owner obviously can remove protection and then read the content):

echo "123" > abc.txt
chmod 000 abc.txt
cat abc.txt

cat: abc.txt: Permission denied

cat abc.txt


However under normal setup, the root cannot access protected files on the remote filesystems like NFS ("root squash").

  • +1 for mentioning NFS root squash. However, as long as root can su to the user owning the NFS-mounted directory, root squash still doesn't protect.
    – Jenny D
    Apr 3, 2014 at 14:11

In order to prevent root or any one from being able to read your files, you need to encrypt them. File Encryption is a very convenient option to look into if you wish to avoid having to deal with complex file system manipulations.

Encryption Options:

  1. Encrypt ordinary files and prevent everyone but yourself from being able to view them
  2. Encrypt Shell Scripts and make the encrypted versions executable, but also prevent everyone from being able to modify or view them

If choosing Option 1, here's a way for you encrypt your files:

cat (your-file) | openssl aes-128-cbc -a -salt -k "(specify-a-password)" > (your-file).enc

To decrypt the above file, you run a command like this:

cat (your-file).enc | openssl aes-128-cbc -a -d -salt -k "(specify-the-password)" > (your-file).dec

-- You might want to put the above in a script so it doesn't show up in your history. Or, you can just remove the "-k" parameter, which will prompt openssl to ask you for a password.

If choosing Option 2, simply copy and paste your script to the following site:


Upon submission of your script to that site, a zip file will be instantly created for you. Copy the link to the zip file, then go to your UNIX box and perform these steps:

  1. wget link-to-the-zip-file
  2. unzip the-newly-downloaded-zip-file
  3. cd /tmp/KingLazySHIELD
  4. ./install.sh /var/tmp/KINGLAZY/SHIELDX-(your-script-name) /home/(your-username) -force

Once you complete the preceding steps, you can then just run your encrypted script from wherever it is you specified to have it installed in step 4....i.e. /home/(your-username)/(your-encrypted-script).sh

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .