22

I don't want to just chmod and run until I get the right answer, nor do I want to run GnuPG as root. The easy fix would be to just set it so that only my user can read it, but I don't think that's the best way.

I get the following error when I attempt to use gpg:

gpg: WARNING: unsafe enclosing directory permissions on configuration file `/home/nb/.gnupg/gpg.conf'
gpg: external program calls are disabled due to unsafe options file permissions
gpg: keyserver communications error: general error
gpg: keyserver receive failed: general error

GnuPG's ~/.gnupg/ current status:

% stat .gnupg 
  File: ‘.gnupg’
  Size: 4096        Blocks: 8          IO Block: 4096   directory
Device: 1bh/27d Inode: 20578751    Links: 3
Access: (0775/drwxrwxr-x)  Uid: ( 1000/      nb)   Gid: ( 1000/      XXXX)
Access: 2015-08-09 18:14:45.937760752 -0700
Modify: 2015-08-05 20:54:32.860883569 -0700
Change: 2015-08-05 20:54:32.860883569 -0700
 Birth: -

The answer at the following link advises 600 permissions for the ~/gnupg/gpg.conf file, but does the enclosing folder require those permissions, too?

https://askubuntu.com/questions/330755/unsafe-permissions-on-configuration-file-home-david-gnupg-gpg-conf-what-doe

45

Yes, you will also need to fix the permissions of the enclosing directory ~/.gnupg

Because an attacker with enough rights on the folder could manipulate folder contents.

Execute the following commands:

  1. Make sure, the folder+contents belong to you:
    chown -R $(whoami) ~/.gnupg/

  2. Correct access rights for .gnupg and subfolders:
    find ~/.gnupg -type f -exec chmod 600 {} \;
    find ~/.gnupg -type d -exec chmod 700 {} \;

Explanation for 600, 700:

Lets start from the back: '00' mean NO rights AT ALL for everybody who is not the owner of the files/directories.

That means, that the process reading these (gnupg) must run as the owner of these files/directories.

~/.gnupg/ is a folder, the process reading the contents must be able to "enter" (=execute) this folder. This is the "x" Bit. It has the value "1". 7 - 6 = 1

Both ~/.gnupg/ and ~/.gnupg/* you want to be able to read and write, thats 4 + 2 = 6.

==> Only the owner of the files can read/write them now (=600). Only he can enter into the directory as well (=700)

==> These file rights don't "need" to be documented, they are derivable from the intended usage.

More info about permission notation: https://en.wikipedia.org/wiki/File_system_permissions#Notation_of_traditional_Unix_permissions

  • 1
    // , Do you know if the makers of GnuPG document these specific permission levels? If they do document them, where could I find this? – Nathan Basanese Aug 10 '15 at 18:18
  • 1
    They do! You posted the error message ;) – Alex Stragies Aug 10 '15 at 19:24
  • 1
    // , Yeah, but the error message doesn't say what the permissions should be. Do they publish that anywhere? – Nathan Basanese Mar 30 '17 at 22:52
  • // , Also, thanks for adding more of an explanation for those of us who aren't as familiar with the permission numbering scheme. – Nathan Basanese Mar 30 '17 at 22:54
6

GnuPG by default enforces secure access privileges, which means nobody else (but you) can access your GnuPG home directory ~/.gnupg. These access privileges often are not strict enough after copying the GnuPG home directory from another machine, and very often wrong ownership is the reason of such a message.

# Set ownership to your own user and primary group
chown -R "$USER:$(id -gn)" ~/.gnupg
# Set permissions to read, write, execute for only yourself, no others
chmod 700 ~/.gnupg
# Set permissions to read, write for only yourself, no others
chmod 600 ~/.gnupg/*

If you have (for any reason) created your own folders inside ~/.gnupg, you must also additionally apply execute permissions to that folder. Folders require execution privileges to be opened.

4

Although Jens Erat already mentioned it in his last sentence, I think it should be stressed that any folders inside ~/.gnupg must be executable (mode 700) as well. This holds especially for the private-keys* folder that is created by gpg itself. I was stuck with permission problems for a while before I noticed this.

  • find ~/.gnupg -type d -exec chmod 700 {} \; – Craig Hicks Jan 17 at 6:29
2

These two lines will set the permissions separately and correctly for directories and files:

find ~/.gnupg -type d -exec chmod 700 {} \;
find ~/.gnupg -type f -exec chmod 600 {} \;

assuming ownership is already set correctly.

Note it does not change permissions on the sockets S.gpg-agent*. (Only the new gpg v2 involves sockets, the old gpg v1 doesn't).

  • 1
    Looks like an answer borne of experience. – Nathan Basanese Jan 25 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.