Is there a benefit to securing all directories under a parent directory?

Question

The sysadmins at work want us to remove all world permissions from all files and directories within a specific filesystem. Normally, I would agree with such security practices. However, I don't understand the point in doing so because the parent directory only allows users within a specific group to access the filesystem.

For example, the parent directory has permissions like:

drwxr-x--- 5 root group 4096 Apr  7 15:27 /example

And the subdirectories have permissions like:

drwxrwxrwx 2 user group 4096 Apr 10 00:34 /example/dir1
drwxrwxrwx 2 user group 4096 Apr  8 12:52 /example/dir2
drwxrwx--- 2 user group 4096 Apr 12 08:13 /example/dir3

Note: /example/dir1 and /example/dir2 are what currently exists. /example/dir3 is what our sysadmins want the permissions to be.

Is there any benefit to removing world permissions from /example/dir1 and /example/dir2 when only users in group can access this filesystem? What are the best practices?

Answer 1

Accountability:

If you have the permission like dir3, you know quickly that who has access to that file. In the other case, you should go back until you see the correct permission.

Safety:

you may need dir4 accessible by webbrowser, so you sysadmin need to change also example, but now he does not know that are the correct permissions of dir1 and dir2.

In general and the best practice: it is always better to use the minimal permissions, so you know (by seeing additional permissions) what are the additional requirements (it is a sort of lazy boy documentation; but we all tend to be lazy on documentation).

Note: some program could complain (and stop) if they find "world/all" permission: they usually check just current directory permission (why do complex checks? and with volumes mounted multiple time, it could be difficult (and not portable) to find possible attacks)