File permissions: the Unix lesson that still saves laptops
Owner, group, everyone else. Why 777 is panic, and why you should not live as Administrator.
Unix treated files as a permission problem from the start. Owner, group, everyone else. Read, write, execute. It looks fussy until the day a random program can rewrite your SSH keys or a world writable script becomes a root shell.
The three numbers people quote
`chmod 755` on a program: owner can do everything, others can run it but not edit it. `chmod 600` on a private key: only you read and write. `chmod 777` is the panic setting. It means anyone on that machine can alter the file. On a shared host, “anyone” is not theoretical.
Windows is not Unix, but the idea is the same. Your user account should not be Administrator for email and browsers. A downloaded program inherits your rights. If you are admin, it is admin.
macOS hides a lot of this. The SSH key in `~/.ssh` still needs to be closed to other accounts on the Mac. If you copied a key from a USB stick and ssh complains about permissions, listen to it. It is not being precious. It is refusing to use a key other people on the disk could have read.
Root is not a personality
Work as a normal user. Use sudo for the one command that needs it. Do not `sudo su` and live there for the afternoon. History is full of `rm` in the wrong directory at the wrong privilege.
Services should run as their own user, not as root, unless they must. A web app that can write `/etc` is a web app that will, eventually.
Home habits
- Private keys: readable by you only.
- Backups: not world readable if they hold mail or tax PDFs.
- Shared folders: a group, not 777.
- Don’t run installers as admin because a random download told you to.
This is the oldest lesson on a multi user machine. Your laptop is a multi user machine even if you are the only person. Software is the other user.