Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Unix-like OS's, what's the point of giving the owner of a file anything less than 7 (rwx) for file permissions? The owner can trivially change the owner permissions for his/her files, and so can a cracker if the acct. is compromised. Setting the owner permission to anything other than 7 seems to just get in the way w/o producing any actual security improvements.

share|improve this question
up vote 4 down vote accepted

It is to protect the user from making a mistake.

If the file is important and should not be modified you give read only. Then if the user needs to change it they will have to make a conscious choice to go and chmod 777 the file and then do the action.

Also not letting things be executable helps. If you are writting a script and have several older version in a sub directory. Turning off the ability to be executable will stop you from running the wrong script.

But the owner can always go back and change the file permissions to what they need when they need it.

share|improve this answer
chmod 777: nonononono! Never ever run chmod 777. It is practically never required! Not even for "testing purposes". If the file is readable, then it's readable. If it's writable by the user or group that need to write to it, then it's writable. There is absolutely zero need to give everyone write permissions, and forgetting to chmod it back to something sane is exactly how multinationals get hacked. Just don't do it. Ever. I wrote an introduction of Unix permissions. Please read it! – Carpetsmoker Mar 13 at 6:01

Not everything should be executable by default... for instance, scripts you're editing should be invoked by [interpreter] [script.file], in case it has a bug you can't accidentally set it off.

Also, some files shouldn't be deleted or changed. So if you set 0400, the user will have to override the perms. Of course most users just blow by "Are you sure?" type questions, but that's another issue.

I commonly use chmod go=,u=rwX which sets 0600 on all files and 0700 on all directories (and files which had 'x' before). Then make any necessary changes (like the public_html directory or whatever).

share|improve this answer

[important] file/dir that you dont want to accidentally rm -rf.

[important] = config / backup / private encryption key, etc etc.

share|improve this answer
rm -rf will delete read only files that you own. However rm -r will prompt you about read only directories. Another option is to put alias rm='rm -i' in /etc/bash.bashrc – Hamish Downer Jun 4 '10 at 15:03
@Hamish: It's a really bad idea to alias rm. What if you rely on it and that one critical time it's not there. – Dennis Williamson Jun 4 '10 at 15:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.