I have found POSIX Access Control Lists allow as you, as the system administrator, to protect your users from the worst of their own ignorance, by overriding the regular user-group-other file system permission, without much of a chance to break anything crucial.
They can be especially useful if you for instance (f.i.) needed home directories to be world accessible because webcontent needs to be accessible for apache in ~/public_html/
. (Although with ACL's you can now do the reverse, remove access for all and use a specific effective ACL for the apache user. )
Yes, a knowledgeable user can remove/override them again, are just uncommon enough that that's unlikely, and those users that can are typically not the ones to conveniently chmod -R 777 ~/
anyway, right?
You need to mount the filesystem with the acl
mount option:
mount -o remount,acl /home
In many distributions the default is to create user groups, each user has their primary group, and I have set all users in a secondary group with the unimaginative name of users
.
Using ACL's it is now trivial to prevent other users from accessing the home directories:
Before:
chmod 0777 /home/user*
ls -l /home/user*
drwxrwxrwx. 2 user1 user1 4096 Jul 11 15:40 user1
drwxrwxrwx. 2 user2 user2 4096 Jul 11 15:24 user2
Now set the effective directory permissions for members of the users
group to 0
no read, write or access:
setfacl setfacl -m g:users:0 /home/user*
ls -l
drwxrwxrwx+ 2 user1 user1 4096 Jul 11 15:40 user1
drwxrwxrwx+ 2 user2 user2 4096 Jul 11 15:24 user2
The +
sign denotes the presence of ACL settings there. And the getfacl
can confirm that:
getfacl /home/user1
getfacl: Removing leading '/' from absolute path names
# file: home/user1
# owner: user1
# group: user1
user::rwx
group::rwx
group:users:---
mask::rwx
other::rwx
The group:users:---
show that group effectively having no access right, despite the regular permissions for other being other::rwx
And testing as user1 :
[user1@access ~]$ ls -la /home/user2
ls: cannot open directory /home/user2: Permission denied
A second common solution on shared systems is to have the automounter mount home directories on demand an a server dedicated to shell access. That's far from fool proof, but typically only a handful of users will be logged in concurrently meaning only the home directories of those users are visible and accessible.
chmod files 0777
is strictly necessary, i.e. address the root cause of the problem, rather than the symptom that, by doing so, anyone can read anyone else's files. Many times the allow all access recommendation is simply a cheap way of avoiding support calls, or lack of technical prowess in being able to set permissions up correctly. In almost no cases have I had to set files0777
or grant applications full root access when requested. Education of the users and/or vendors helps massively here.suexec
ormpm_itk
or similar.chmod 0777
their files. I think he's nervous about them going tololtoturialz.com/php_problems
and settingchmod 0777
on their own while blindly following a poorly written article. There's really no way to prevent them from doing so, or to prevent them from being upset when someone steals their stuff.