Warshaw

Notes on file permissions

2026-10-25

The simplest permission model is still the most useful one: each service runs as its own user and owns only the files it needs. Everything else is readable at most, and secrets are readable only by their owner.

It sounds obvious, yet many small servers run everything as the administrator because it was easier on day one. Untangling that later takes far longer than setting it up properly at the start.