Is it safe to chmod 777 everything?

Question

I'm having trouble pulling the whole file directory from a rooted android device with ADB. There are special permissions errors. So I thought a solution would be to chmod everything so the ADB daemon effectively runs with root permissions (can't run it with root permissions directly). Then possibly chmod everything back to the way it was after I've pulled all the files with adb pull.

Are there any risks involved with this approach? What about not changing the permissions back to normal? While my case is specific to android I'd be interested to hear any difference for normal linux systems.

Solution 1

By changing everything to 777, you are bypassing most of Linuxes privileges security settings, and this would be considered unsafe, and definitely not best practice.

The problem is that if someone can penetrate your system as a user other than yourself, if your files are CHMOD 777, they can read, write, execute and delete them. This is considered a security threat.

Similarly, having files with "777" permissions means that if someone can find a non-executable file, and overwrite it with a script, and can trick you to run that file, it will execute, which is a security risk.

If it were me, I definitely wouldn't do it, but if you are the only user of your system, and you are not worried about targeted attacks, you might be able to get away with it on an Android device (you are vulnerable, but somewhat insulated by the privileges system and single-user nature of the device) - but doing it on any kind of Linux server is begging for it to be hacked.

Solution 2

There are many situations where chmod 777 actually breaks functionality. There is absolutely no situation where you want to do this.

Comments

[Nelson]

How do you plan to reverse the chmod 777? This is non-trivial at best, and probably impossible at worst.

[PBI]

In addition: some commands even check the permissions, and if they are too wide, refuse to work. Most ssh-authentication falls in that category.

[Baldrickk]

I was going to make this comment. On linux at least (can't really speak for android) there are a number of applications that check their permission levels before running. If they don't have the exact permissions, they refuse to run, as it probably means someone is trying to run them that shouldn't be. - see the linked question for an example of someone making this mistake...