Is it safe to remove read, write, and execute permissions for 'others' recursively on home directory?

Question

I would like advice on whether it would be safe to block users not in the appropriate group from accessing my home directory. I have some servers running on my Mac (10.9) under a different account, and wish to decrease the consequences of a hacker exploiting one of them by preventing this account from accessing any of my personal files.

I am intending to use file permissions for this, but I am concerned that this may break something, by blocking system processes from doing what they need to. I would ideally like to block all but root and my primary account from accessing my primary account's home directory, with chmod -R o-rwx ~.

Does anyone know whether this would cause any problems, and also whether it would be effective in preventing other accounts (that may not sudo, and are not admin in System Preferences, these may be the same, not sure) from accessing these files, excluding an EoP vulnerability?

Answer 1

That depends on what is running on the server. If you have a web server running and serving other user's content from their home directories than the web server would not be able to read those files.

When making this decision the group that the users belong to is also important. If all users are members of the staff group for example and if the home directories have read and execute permission for that group than other users will still be able to access those directories.

However in general it should be safe and probably even the preferred method.

Answer 2

I would not be changing permissions recursively on a user directory, ever. This chances breaking too many things, particularly in the ~/Library folder.

The permissions structure of OS X is fairly robust and only allows privileged users or processes access to directories/files. Admin users can always sudo to affect changes (as members of the sudoers list) but are otherwise normally blocked from access to other users' Home directories other than the Public folder or any shared folder through File Sharing.

Firewalling in front of your system is going to be a more secure method of blocking access to hackers.

Answer 3

Unless you have changed it (or enabled sharing) only users in your group should have read access, but I can see no harm in removing permissions for others

Answer 4

Your approach is perfectly secure, and used as a basic rule in securing any Unix filesystem. This approach will protect you from any non admin account access, and protect you from becoming a deposit area for crapware coming from other accounts. The uniq directory which is relevant to get an other access right is:

Public/Drop Box

Hence I advise you to avoid a basic:

chmod -R o-rwx

and prefer:

cd
find . \( -path "./Public/Drop Box" -prune \) -o \( -perm +0007 -ls \)

to check what you will modify, and then:

cd
find . \( -path "./Public/Drop Box" -prune \) -o \( -perm +0007 -exec chmod o-rwx {} \}

If any software might get broken, then this software is a security problem or a crapware. It is a good idea to detect these weaknesses as soon as possible.

Look at umask shell builin to avoid appearance of files whith any kind of other access.