1

Enigmail wants $USER to have the write permission on ~/.gnupg/ directory but the gpg tool then complains about insecure permissions :

$ ls -ld ~/.gnupg
drwxrwx--- 1 root xyzt 248 févr. 25 16:34 /home/xyzt/.gnupg/
$ sudo gpg --list-keys >/dev/null 
gpg: WARNING: unsafe enclosing directory permissions on configuration file `/home/xyzt/.gnupg/gpg.conf'

and if I switch the group and user owners, I get another warning :

$ sudo chown -R $USER:root ~/.gnupg
$ ls -ld ~/.gnupg
drwxrwx--- 1 xyzt root 248 févr. 25 16:38 /home/xyzt/.gnupg/
$ sudo gpg --list-keys >/dev/null 
gpg: WARNING: unsafe ownership on configuration file `/home/xyzt/.gnupg/gpg.conf'

What are the owner and permissions on ~/.gnupg/ and ~/.gnupg/gpg.conf to satisty both GnuPG and Enigmail ?

1
  • It's complaining about the read/write privileges. Root should not be ownign that.
    – Thomas Ward
    Feb 25, 2019 at 15:55

1 Answer 1

4

The problem you have is the ownership and permissions on both folders and files in there. The home directory ~/.gnupg directory should only be owned by that user, and NOT by any other user; the same applies for the directory's permissions and the file permissions inside it. (root would still be able to read to, write to, and traverse through it anyways, you don't need root to be group or owner for any reason)

Set the owner for the configuration file to your user and group:

sudo chown $USER:$USER ~/.gnupg

Then make sure it's only readable by your own user - no other users OR groups should be in the permissions schema:

sudo chmod 700 ~/.gnupg

Specifically for that last error about gpg.conf having insecure permissions, also make sure that gpg.conf is in read/write for user, read-only for group, and read-only for 'other':

sudo chmod 644 ~/.gnupg

This should resolve the errors you're seeing. (You can use sudo for these commands, but DO NOT use sudo when working with your own GPG keyrings or using the gpg command unless you need root's keyring - you'll have incorrect permissions otherwise).

4
  • Thanks Thomas. BTW, I was using sudo gpg because I thought the Launchpad PPA repos. keys where stored in /etc/apt/trusted.gpg.d/
    – SebMa
    Feb 25, 2019 at 16:06
  • @SebMa Those're only manged by apt-key - you need sudo for that but NOT for other gpg commands such as key retrieval and such from key servers, or for messing with your local gpg.conf or such
    – Thomas Ward
    Feb 25, 2019 at 16:08
  • Can you please have a look at my other question regarding apt/gpg, because it seems I have messed things up a bit on my other PC : askubuntu.com/q/1120843/426176 ?
    – SebMa
    Feb 25, 2019 at 16:11
  • @SebMa That issue I can't assist with; it's a different issue unrelated to filesystem permissions like this one is.
    – Thomas Ward
    Feb 25, 2019 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .