Correct permissions in /home and /home/user

Hi geekos!

I’m currently investigating some issue with some apps (Nautilus, Firefox, …) seeming to have trouble with my file system (maybe). I am on Leap 16.0, Gnome. I think I went with a fairly standard installation here, sticking close to defaults.

Just wanted to confirm that my current permissions on /home and $HOME are correct. /home/user Permissions? and “random pieces of information on the internet” are not super helpful, and I don’t want to mess with permissions in these places :upside_down_face: :grimacing:

The home directory has read and execute permissions, but not write, not even for the root user.

># ls -ld /home
dr-xr-xr-x. 1 root root 14 16. Jan 2026  /home

My $HOME has all rights for me, and none else.

~> ls -ld /home/pbiel/
drwx------. 1 pbiel pbiel 996 22. Aug 10:59 /home/pbiel/

$HOME is pretty much what I expect, but for /home I would have rather expected w for root, and not really x for group and others. Or so.

I’d be happy if someone more experienced can confirm this is correct, or point to errors. There is some documentation at https://doc.opensuse.org/documentation/leap/security/html/book-security/sec-sec-file-management.html#sec-sec-prot-general-home-permissions, but I am not sure whether it describes the desired/required state, or is some proposal, or what. Could not find a document clearly stating what Leap will set up by default.

Hello,

these permissions are set on my default Tumbleweed install as well and seem correct to me. Noone is supposed to be allowed to create files/folders in /home outside their own home-folder and the owner is supposed to be the only person to access his own home-folder.

If you want to find out whether the permissions are set as desired for new users and their home-folders on your system you would have to create a test user and if necessary set HOME_MODE in /etc/login.defs (following the link you posted)

If you have trouble concerning the permissions of newly created files or folders you would have to check

umask -S

That gives you what permissions are set for new files and directories. On my system e.g.:

user@xyz:~> umask -S
u=rwx,g=rx,o=rx

The root user is allowed to do anything and does not need explicit permissions; that is how a new /home/ directory is created when you add a new user to the system.

This is rather normal:

henk@boven:~> ls -ld /home
dr-xr-xr-x 10 root root 4096 Aug 17  2022 /home
henk@boven:~> ls -ld /home/henk
drwxr-xr-x 38 henk wij 4096 Aug 22 12:31 /home/henk
henk@boven:~> 

Takle note of the strange permissions of /home/pbiel in your first post above. Now members of the group pbiel and all other users can not do anything inside the home directory og user pbiel. If that is what you want, it is OK.

Maybe more explanation:

Please read up on ownership and permissions:

  • root always has all permissions. thus it does not need special w for anything.
  • when there are no r and x bits set for everybody for /home, nobody (except root) could even look inside /home, very bad for all users.
  • for a directory, x has nothing to do with “execution”, but it permits access to the inode.

That is the current standard for openSUSE and namely for Leap 16.
Existing systems originally installed a few years ago or new users created with YaST-Users in Tumbleweed may have a different pattern.

2 Likes

What you have has never been normal. openSUSE does not have a wij group. And these changes are not new, they have been announced and IIRC were even in the release notes.

What is abnormal? I manage my user population according to need.

The OP asks about the permissions he sees and doing this also shows (s)he has some misunderstandings about what the permissions mean (spcecial when it is about root). I try to show him a different situation and try to explain. what the difference means.
I did not tell him what he “should do”, nor what “is normal”.

I admit that it would have been better to formulate one post with a more logical and better educational approach. Sorry for not taking the time to do that.

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.