3

I have been learning Python and Bash scripting, and I up to now I have given my scripts 777 permissions. Having learned more about how to set permissions, and knowing this is a bad idea, I ran the following command (On Mac OSX, v10.6.8):

find / -type f -perm 0777

I was expecting to only get a small list of files that I had assigned 777 permissions, but instead I got a huge list. (1,503 to be exact.) These include my small number of scripts, as well as all of my image files, html and css files, example code that came with ebooks, as well as files related to applications such as Adobe Flash Catalyst, Smith Micro Anime Studio, something called Microsoft Play Ready (I assume this is part of Silverlight), and others.

I'm kind of new at this, but isn't this a problem? Should any files have 777 permissions?

Improve this question
6
  • Files (on Unix file systems) are usually created without execute rights. Thus you probably either have copied them from a VFAT volume or have executed something like chmod -R 777 . in the past. Even a umask of 000 or rwx default ACLs should not cause such files.
    – Hauke Laging
    Mar 16, 2013 at 16:02
  • The image files were copied from a windows machine, an NTFS volume, I believe. I have only run chmod 777 on my python and bash scripts. Many of these files seem to have been installed by applications, (adobe, anime studio, etc.)
    – John Aten
    Mar 16, 2013 at 16:09
  • Do the files have an ACL? ls -l shows a + after the permissions (e.g. -rwxrwxrwx+) if there is one, and ls -le shows the ACL.
    – Gilles 'SO- stop being evil'
    Mar 16, 2013 at 23:43
  • Note that Soft Links always have permissions of 777. This is not a security risk.
    – Johan
    Mar 17, 2013 at 8:22
  • Also note that files copied in from FAT/FAT32 formatted disks often end up with wildly permissive permissions.
    – Johan
    Mar 17, 2013 at 8:26

2 Answers 2

Reset to default
3

It is really not normal to give files 777 permission. I cannot think of a legitimate reason for any file to have such permission, but if exists, it had better have a really really good reason.

I advise you to change those permissions immediately.

  • At the minimum, remove the write permission of others, with chmod -R o-w
  • Most probably you also want to remove the write permission of the group too, with chmod -R g-w
  • Personally I really don't like seeing image/audio/video/document files with executable bits on. I would remove those too, with something like find /path -name '*.png' -exec chmod a-x {} \;

In the future, be more careful. It is security 101 to not give more permissions than really needed. For example you can start by setting all files to 0400 and all directories to 0500 and then see what is not working and gradually add the bare minimum permissions.

What is the output of umask in your system? If it is more permissive than 0022 then I think you might want to add in your ~/.bashrc the command umask 0022. This has the effect that new files you create will not have write permission for group and others by default.

Improve this answer
3
  • umask returns 0022. Thank you for the information. I will follow your recommendations. I am still curious about the files associated with applications, though. Should I check the permissions every time I install something?
    – John Aten
    Mar 16, 2013 at 18:23
  • Normally you don't need to check the permissions every time, unless you want to be suspicious. It's strange how those application files got such permissions.
    – janos
    Mar 17, 2013 at 7:55
  • Yeah, I was wondering if this hinted at a problem of some kind.
    – John Aten
    Mar 17, 2013 at 16:18
1

permission 777 is not Necessary for all files.

permissions are : rwxrwxrwx , which are three group of "rwx" first for owner user, second for owner group and third for others.

777 is binary of 111 111 111, so: 777 -> rwxrwxrwx

another example : 760 ->rwxrw----

if a file is not executable, it's not Necessary to give it execute permission, like Ebooks.

and if you have an executable program like a bash script,and you don't want to let others execute the script, the third num of the third part must be zero , I mean :??? ??? ??0

for example you want to let others read your script, but you don't let them to write or execute it, so the permission will be : ??? ??? r-- =>??4

Improve this answer
1
  • 1
    I understand the basics of permissions. I ran the find command to get a list of files on which I needed to restrict the permissions. My main question is: should any files be allowed to have 777 permissions and if so when/why? Should I change any/all of these files to more restrictive permissions? Also, does this indicate a past problem and/or pose a potential problem?
    – John Aten
    Mar 16, 2013 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.