20

I am wondering why by default my directory /home/<user>/ has permissions set to 755. This allows other users to enter into directories and read files in my home. Is there any legitimate reason for this ?

Can I set the permissions to 700 for my home and all sub directories , for example: 

chmod -R o-xw /home/<user>/ 
chmod -R g-xw /home/<user>/

without breaking anything ?

Also, is it possible to set the permissions on my home, so that all new files created will have 600 and directories 700 ?

Improve this question
2
  • 1
    in RHEL/CentOS 5 default is 700, but in Ubuntu 755 – Rahul Patil Oct 13 '13 at 21:17
  • 2
    It's common in certain setup which use public_html to allow the web server access to the directory. Although it's very convenient for users, I'm not a big fan of it. – Marco Oct 13 '13 at 21:30
21

If your home directory is private, then no one else can access any of your files. In order to access a file, a process needs to have execute permission to all the directories on the path down the tree from the root directory. For example, to allow other users to read /home/martin/public/readme, the directories /, /home, /home/martin and /home/martin/public all need to have the permissions d??x??x??x (it can be drwxr-xr-x, or drwx--x--x or some other combination), and additionally the file readme must be publicly readable (-r??r??r??).

It is common to have home directories with mode drwxr-xr-x (755) or at least drwx--x--x (711). Mode 711 (only execute permission) on a directory allows others to access a file in that directory if they know its name, but not to list the content of the directory. Under that home directory, create public and private subdirectories as desired.

If you never, ever want other people to read any of your files, you can make your home directory drwx------ (700). If you do that, you don't need to protect your files individually. This won't break anything other than the ability of other people to read your file.

One common thing that may break, because it's an instance of other people reading your files, is if you have a directory such as ~/public_html or ~/www which contains your web page. Depending on the web server's configuration, this directory may need to be world-readable.

You can change the default permissions for the files you create by setting the umask value in your .profile. The umask is the complement of the maximal permissions of a file. Common values include 022 (writable only by the owner, readable and executable by everyone), 077 (access only by the owner), and 002 (like 022, but also group-writable). These are maximal permissions: applications can set more restrictive permissions, for example most files end up non-executable because the application that created them didn't set the execute permission bits when creating the file.

Improve this answer
2
  • I am not running a web server on my machine, so I don't need to allow access to ~/public_html. Are there any other common programs other than Apache, which could need access to my home? What about postfix, for example. – Martin Vegter Oct 14 '13 at 8:19
  • 2
    @MartinVegter Good point. Email programs always run as your user when they're delivering mail, but some systems require .forward to be readable by a mail system running as a system user. Postfix however is fine with a private .forward. – Gilles 'SO- stop being evil' Oct 14 '13 at 9:03
5

If you check in RHEL/CentOS 5.x, the default Permission is 700, but in Ubuntu it is 755.

According to an Ubuntuforms.org staff member, it is to make it easier to share files between new users. You can change the permission to either 700 or 750 if you don't want the files readable and executable by others.

Also, is it possible to set the permissions on my home, so that all new files created will have 600 and directories 700 ?

You can set umask 0077 for that

It will work like:

Default permission for directory is 0777, so when you set umask 0077 then new directory will create with permission (0777-0077) i.e 0700 as you want.

Improve this answer
2
  • does umask apply to files as well ? It seems to only have effect when I create new directories. – Martin Vegter Oct 13 '13 at 21:41
  • 2
    Yes... you can check in your current shell just set umask 0077 and create file,dir and check permission stat filename – Rahul Patil Oct 13 '13 at 21:45
4

Yes, there is a very legitimate reason. Note that other users can read but not write to your files. This is very useful in professional networks because you can easily share your files with your colleagues.

For example, in the lab I used to work in, we all had access to each other's $HOME directories so we could easily share our data or our scripts with each other. If my friend Alice had a nice script for doing X, I would just run it:

~alice/bin/scriptX.pl mydata

As others mentioned, to change this you will need to set umask. For example, to make new files and folders readable only by you, add this to your ~/.bashrc:

umask 0077
Improve this answer
2
  • 5
    The bit about using Alice's Perl script is terrifying. Copy the script to your home directory, audit it, and then only use your copy. – user9031 Oct 14 '13 at 2:09
  • 7
    @AlexWebr first of all, I would read it first, second Alice in this case is the person sitting next to me who just wrote a cool script. We can assume that I trust them as much as I would any developer whose work I would blindly install and execute on my machine. More than most actually. Also, this was a lab so we often downloaded a few GBs of genomes and it was an easy way to give each other access to them. – terdon♦ Oct 14 '13 at 2:12
1

You need to change the umask, to change how new files are created in your home folder. This is usually done by editing your shell startup script, there's a pretty good overview here

As for changing all the permissions in your home folder to 700, I'm wondering how that would affect services running under service accounts that need config info from your home folder... You may end up prevent these services from reading configuration files they require.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.