Default owners/permissions of files in user home directory
NO file in ~
has to be owned by root.
If a software requires that a file in your home directory be owned by another user, it is a bug and should be reported as such.
Other than that, a common case involves two security-related software that require restricted permissions on certain files, namely:
- SSH
- GPG
SSH
See man ssh
, section FILES
:
~/.ssh/config
This is the per-user configuration file. The file format and
configuration options are described in ssh_config(5). Because of
the potential for abuse, this file must have strict permissions:
read/write for the user, and not writable by others. It may be
group-writable provided that the group in question contains only
the user.
~/.ssh/identity
~/.ssh/id_dsa
~/.ssh/id_ecdsa
~/.ssh/id_ed25519
~/.ssh/id_rsa
Contains the private key for authentication. These files contain
sensitive data and should be readable by the user but not acces‐
sible by others (read/write/execute). ssh will simply ignore a
private key file if it is accessible by others. It is possible
to specify a passphrase when generating the key which will be
used to encrypt the sensitive part of this file using 3DES.
Other files like authorized_keys
, known_hosts
, etc. should be writable only by the user, but can be world-readable.
GnuPG
~/.gnupg
(and contents) should be accessible only by you. With other permissions, GPG will complain about unsafe permissions.
In general files and directory in your home should be owned by you.
I have some strange root-owned files that are probably the result of executing sudo
command; in fact there are programs that write things under $HOME
(which well behaved programs requiring super-user privileges shouldn't do --- the effect is root taking ownership of files that should belongs to the user).
Normally deleting or re-owning them (depending on the file) does not create problems and often it solves some, like the infamous .Xauthority
file --- and sometimes, after running sudo dconf-editor
, you have things in configurations you can't modify anymore.
About special modes:
- scripts must be executable, of course, at least to the owner;
- so must be directories too (where
x
means right to cross); -
.ssh
must bedrwx------
(0700) and the private keys in it-rw-------
(0600) - if you have a
Public
directory for sharing, it should be probablydrwxr-xr-x
(read permission to anyone) ordrwxrwxrwt
(with write permission and sticky bit, for enabling writing).
... I can't think to anything more needing special treatment.