3

I found a strange directory in my home directory on Linux Mint 17.2 Cinnamon (though I'm pretty confident it's on all Linux distros) called .gnupg. It has no access given to ANYONE other than root. So I have three questions:

  1. What is this directory? What does it contain?
  2. Why is it placed in the user's home directory yet doesn't give them any access?
  3. Will it do any harm by just entering the directory as root?
  • 1
    did you ever run gpg (or mutt or something else which might have run gpg) while su-ed to root? – cas Dec 2 '15 at 3:51
  • I may have when copying commands off instructions but why? – Rohan Dec 2 '15 at 4:12
  • @Rohan that would give root permission of that file if in a certain context – cutrightjm Dec 2 '15 at 4:17
  • So I made it owned by root by running the command? – Rohan Dec 2 '15 at 4:18
  • 1
    yep. when root creates a file or dir, it's owned by root. – cas Dec 2 '15 at 4:33
6

Most dot files have a name that resembles the application that uses it. Unsurprisingly, .gnupg is used by GnuPG. GnuPG (also known as GPG) is a program that encrypts and signs files. As soon as you invoke it for the first time, it will create a .gnupg directory in your home directory and a few files in it. This directory contains a lot of private information (e.g. who your contacts are), so it's accessible only to the owner. This could happen, for example, if someone sends you a signed email; if your email client supports PGP email then it will attempt to verify the signature (and fail since you don't have the sender's public key in your GPG keyring).

The real question here is why this directory in your home directory is owned by root. The answer is that you ran GPG as root, but with HOME set to your own home directory. Or, more precisely, you ran a program which ran GPG under the hood. One such program is APT: package management tools (apt-get, apt, aptitude, etc.) use GPG to verify that the packages that you download are genuine. If you ran something like sudo apt-get install SOMEPACKAGE, this would create a .gnupg directory in your home directory, since sudo doesn't change the home directory by default.

The fix is to remove the .gnupg directory, then create it under your user. You can just remove the root-owned directory (sudo rm -r ~/.gnupg): any file under your home directory is fair game for you. You could alternatively move it to root's home directory (sudo mv ~/.gnupg /root), but it doesn't contain anything important anyway. Then run a GPG command such as gpg --list-keys; this will populate your ~/.gnupg directory with empty keyring files.

Just entering a directory is always harmless. Listing files and viewing their content is usually harmless, but it can be harmful in some configurations because terminals parse escape sequences in what applications print. Under Linux, plain ls or ls -l is fine but ls -N is potentially risky. Plain cat filename is risky but less filename is fine (whereas less +R filename is risky). In the .gnupg directory, there's nothing harmful.

  • Is it important for me to make it owned by me again? I am likely going to run sudo apt-get ... MANY times in the future, so it may be a vain task. Also, thank you for the explanation, though I am still a Linux noob, so I didn't get a lot of it :(. – Rohan Dec 3 '15 at 3:46
  • @Rohan If ~/.gnupg already exists, running GPG as root will still work fine. I think it won't touch it at all in this case, the only problem is that gpg creates ~/.gnupg if it doesn't already exists, and then the owner is the user that ran gpg, not the user whose home directory the directory is under. – Gilles 'SO- stop being evil' Dec 3 '15 at 10:18
  • so should I still make it owned by me, or will it just get changed back after sudo apt-get ...? – Rohan Dec 3 '15 at 20:40
  • @Rohan Yes, make it owned by you (or rather: delete the one created by root, then create one owned by you). It won't get changed back. – Gilles 'SO- stop being evil' Dec 3 '15 at 20:43
  • Thank you, worked like a charm! But just out of curiosity, what might happen if I left it owned by root? – Rohan Dec 4 '15 at 4:17
2

The directory ~/.gnupg is where configuration files for GnuPG, the GNU Privacy Guard, reside. This is a common cryptography tool (see https://www.gnupg.org/).

Its permissions should give you access, and perhaps nobody else. If the directory is owned by root on your system, that is strange. Is it really? Check by running ls -ld ~/.gnupg.

This directory by itself causes no harm, and it's OK for you to look at what is inside.

  • I've checked everything. ls -ld ~/.gnupg returns `drwx------ root root' as the permissions. – Rohan Dec 2 '15 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.