Ny standard on the permissions for system directories

homepermissionsSecurity

The /root directory on CentOS 6 has permissions 0550 but on Debian 7 it is 0700. The Filesystem Hierarchy Standard (FHS) tells about directory organization but remains silent about permissions. Do distributions aspire to be compatible to any standard or it is mostly a matter of following tradition?

EDIT 2. Further, /usr/local on CentOS has permissions 0755 while on Debian it is 2775. My hope is that the good folks here might be able to tell (or point to a document) about common practices along with justifications. The FHS would have been the right place but alas it does not say anything about permissions.

Best Answer

All else being default, 0550 and 0700 have no practical differences for /root: the directory has group "root" so the group permissions make no difference, and whether or not the "root" user is given write permission is moot, because he's root anyway.

The difference between 2775 and 0775 for /usr/local also does not usually make a difference: the sticky bit for directories ensures that only the creator of files may delete them, but the default permissions only allow user "root" to create files anyway, who is also the only user given permission to delete them. The sticky bit would become relevant if you allow a non-root user to create files or subdirectories in there.

Therefore, these two choices only represent different philosophies and don't usually offer any practical differences.

I'm sorry that I haven't been able to point to relevant standards here, except to say I don't think there are any. How you set up your file permissions is up to you, the system administrator, and distributions just have their own way of doing it for you that balance security and usefulness.

Related Question