1

TLDR: How can I change permissions of all folders in the computer such that, for "others", the folders loose only readability? In other words, they keep their status regarding "write" and "execute", but loose the possibility of "reading" in case they had it in the first place?

Long version: While configuring a server (where users can SSH to) for the first time, my first inclination was to try to find out how one could create new users that are allowed to access only their own home/username folder and subfolders.

However, I found some references (for examples this question/answer) online explaining that that would perhaps not be a good idea because users would of course need to still access some system folders like usr/bin or usr/lib and to write to folders like tmp. Of course, it does make sense. Then, what I have tried to accomplish instead is to have users be able to use what is in the system folders but not see their content.

More specifically, that would mean setting all folders in the system to not be readable to "others" while still maintaining their original status to "others" in respect to writability and executability. For example, a folder with permission 754 would become 750, a folder with 756 would become 752, a folder with 755 would become 751, etc, while a folder with 753, 752, 751 or 750 would stay the same. So on and so forth.

This way, no one besides the root would be able to see what is inside any folder besides their home/username folder and subfolders, but she could still execute and write normally throughout all system folders that originally allowed so.

How could I a do that for all folders? Comments on the possible flaws of this idea are of course welcome too.

Improve this question
2
  • I'm asking my self - why 750 octal permission for the user's home directories is not enough to prevent the users to access each other user's home directories?
    – pa4080
    May 24, 2019 at 4:58
  • @pa4080 because in a harsher case, I wanted to prevent users from seeing the contents (but still use what lays within) all folders in the machine that are not in their own home folder. Does that make sense?
    – Jorget Millani
    May 24, 2019 at 5:43

2 Answers 2

Reset to default
1 
find /path/to/directory/ -type d -exec chmod o-r {} \;

should work. For every folder, find executes chmod. chmod then removes the read bit for others.

Improve this answer
3
  • 1
    I hope a new user doesn't read this and unwittingly use: sudo find / -type d -exec chmod o-r {} +
    – WinEunuuchs2Unix
    May 24, 2019 at 11:48
  • @WinEunuuchs2Unix could you add a bit more about why that wolud be a problem? More specifically, why would it be bad for the root to do that and then set only the users' subfolders under home to be readable for users?
    – Jorget Millani
    May 28, 2019 at 18:11
  • 1
    Most new users here are on a single user system.
    – WinEunuuchs2Unix
    May 28, 2019 at 19:35
0

Only binary objects opened by the kernel itself can be flagged as executable but not readable. Any type of script (bash, python, etc.) would have to be first read before being executed. See:

Improve this answer
1
  • Jorget Millani wanted all folders to get the read permission removed. And a file in a folder without read permission but execute permission can still be acessed if one knows the file-name of the file inside the folder.
    – user958619
    May 24, 2019 at 11:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .