Ubuntu QA:
BlogBrainstormPackage status
Log in
Ubuntu QA
The Ubuntu community has contributed 21986 ideas, 135057 comments, 2615221 votes
Idea sandbox Idea sandbox
Popular ideas Popular ideas
Ideas in development Ideas in development
Implemented ideas Implemented ideas
Idea #6111: Deny read-access of anyone's home folder by Guest account.

Written by diablo75 the 30 Mar 08 at 18:09. Category: Security. Related project: Nothing/Others. Status: New
Rationale
So I just read this thread on Ubuntu Forums about a guy whose porn collection was exposed by some twerp using the guest account login. Just browsed right to him home folder and opened it all right up in front of his family.

Uh.... don't know about you... but this seems like a really really stupid default preference (if true).

Idea: Don't grant limited users access someone else's home folder by default.
Tags: (none)

183
votes
closed
Solution #1: Auto-generated solution of idea #6111
Written by diablo75 the 30 Mar 08 at 18:09.
Ubuntu Brainstorm was updated in January 2009. Since the idea #6111 was submitted before this update, its rationale and solution are not separated. Please vote accordingly, and if you have the necessary rights, please separate the rationale from the solution. Thanks!

Propose your solution

Attachments


Duplicates


Comments
maybeway36 wrote on the 30 Mar 08 at 20:16
If it complies with everything, then yes!

ubuntu_demon wrote on the 30 Mar 08 at 20:38
see also :
http://brainstorm.ubuntu.com/idea/6106/
http://brainstorm.ubuntu.com/idea/5287/

K-Man wrote on the 30 Mar 08 at 22:34
I am sure your family still loves you. I mean... er... your friend's familiy still loves him. ;-)

_sebastian_ wrote on the 31 Mar 08 at 00:26
what is it that most ppl have porn but are embarrassed to share with others... ;-)

Quote [scrubs] Dr Cox: "...i am fairly sure that if they took porn off the internet, there would only be one website left and it would be called 'bring back the porn'..."

johan wrote on the 31 Mar 08 at 02:26
Yes. Hell yes!

alberge204 wrote on the 31 Mar 08 at 06:56
Nautilus > your porn folder > Properties > Permissions > Others > Folder Access: None.

Problem solved.

Eldmannen wrote on the 31 Mar 08 at 08:39
alberge204,
All my data files that resides in MY home directory should be non-accessible by default to anyone but me.

davidpbrown wrote on the 31 Mar 08 at 09:33
Sorry but this is a very BAD idea.. data *should* be accessible by default. Locking everything down is a windoh's mindset.

The benefits of free access outway the upside of having everything restricted.

Obviously, other's data shouldn't be writeable but readable yes, the same way as the system files are visible to all.

IF you have reason to then set permissions for parts of your data.

mikaelstaldal wrote on the 31 Mar 08 at 10:52
What are the benefits of free access to your home directory?

cheesehead (Brainstorm admin) wrote on the 31 Mar 08 at 10:55
Hide your porn someplace else.

davidpbrown wrote on the 31 Mar 08 at 11:29
What are the benefits to restricting everything by default, so everyone must then fight for access to something that might be useful that they are unaware of?

Restrict those things that truely need restricting but don't limit access to everything because somethings might need it.

This is unessesary control freakery. A liberal approach is better.

Who knows what benefits come from freely communicating data?
(Maybe your s.o. should know you're a pervert ')

Eldmannen wrote on the 31 Mar 08 at 12:15
cheesehead,
Like where?
I thought the best place would be my home directory. I thought that MY files stored in MY home directory could only be accessed using MY account.


dan.fernandez wrote on the 31 Mar 08 at 14:35
cheesehead,
where do you suggest to hide porn, on /bin/laden ?

No, seriously, it may be porn on a home pc, it may be homework on an school pc. Normal users should not be able to peek on other user's files, EXCEPT where explicitly allowed.

DylanMcCall wrote on the 31 Mar 08 at 14:36
You do have control over permissions of your own files. The best way to do it is to create a folder and turn off read permissions for all users except yourself.

Unfortunately, that is not the most obvious solution, but the idea of a big "hide this file" button is not very appealing. Perhaps a middle place? There was discussion somewhere of how cool it would be if Nautilus emblems could be attached to scripts so they actually did more than superficial changes... perhaps that could be applied here, for example.

yztlyrn wrote on the 31 Mar 08 at 14:46
Okay you want /home/you locked down. Lock it down. This is Linux not Windows. Do it your d*mn self.

takdavid wrote on the 31 Mar 08 at 14:52
Learn thinking about access rights in terms of user/group/others and read/write/execute, this is why it's working (quite well) decades ago.

jflaker wrote on the 3 Apr 08 at 01:08
I know how to do permissions on a volume, folder or even an object......does the average newb or "average user" know how?

If you mention security to someone who in general terms is slightly scared of the computer to begin with, they will look at you like a deer in the headlights.

I agree that a more OBVIOUS way to set security needs to be done that leaves little doubt to the results...Basically a dumbed down applet to do the same job as right clicking to properties and clicking on the permissions tab......

Also, the /home/*USER* should by default be locked to the user only on creation....either on install

just another morsel of food for thought.

lomash wrote on the 14 May 08 at 23:28
Here is my situation...

I have many documents, files, financial statements, tax filings, etc in my home directory. I want them to be not visible to any other users.

When friends and family come for a visit and they want to use my computer for checking email etc, I let them log in using guest account.

Problem is, the guest account can easily browse my own home dir and view all files. (I don't know why... I did not expect it to be like this by default)

My first action was I changed my home directory permission to drwx------ so only I could have access to it.

That did the trick, but only temporarily. I keep my php files also within my home directory and link them from apache. This is my personal preference because I like to keep all the files that I personally create under my home dir. (This is probably a seperate discussion... ) But anyway, the php script stopped working after I changed the permissions.

It seems counter intuitive, but this is how I solved the problem:
1) Changed my home dir permission to drwx---r-x
2) Changed guest's and my account's main group to users

This works because both user ids are in same group, and the access to group has been restricted. So guest account can't browse my home dir anymore. I think this is a strange solution to this problem.


Post your comment