Does chmod 700 hides directory from other users or just restrict them to display files inside the directory?

My home directory contains 'project' as a directory which contains 'confidential' as sub-directory and 'confidential' contains some files.

I just want that only I can access this folder and other users can't access it.

I ran command

Me:~ me$ chmod -R 700 project/confidential 

Me:~ me$ su Bob

bob:/home/me/project$ ls

code confidential

Here it displays two folders to Bob, but Bob can't access confidential files if he tries to list them.

So, Does chmod not hide the folder from other users? I want other users to access only 'code' directory not confidential, how can I hide it?

1 Answer

Your current directory tree is something like:

/home/me/project/
/home/me/project/code/
/home/me/project/confidential/

You cannot hide the confidential directory, if you want other users to be able to find out and access any directory besides confidential. The parent directory (/home/me/project/) obviously needs read and execute permission to other users, for them to be able to list the contents of the project directory and find out that a directory named code exits. For this reason they can find out that another directory (called confidential) is present besides the code directory.

To completely hide the directory confidential, you can put it into another sub-directory (say /home/me/project/etc/) and give 700 permission to it (the etc directory). This way, the other users will see the etc directory, but will not be able to change into it or list it (or any of its sub-directories). So the confidential directory will be completely hidden.

Another option may be this:

chmod 711 /home/me/project/
chmod 700 /home/me/project/confidential/

This way, you prevent other users to read the contents of the project directory: ls -l /home/me/project/ will give Permission denied error. But, they will be able the change to the project directory or any other sub-directory they know it exists and list it: ls /home/me/project/code will work, provided the code directory has the "normal" (755) permissions.

However, in this configuration, note that the outputs of the following commands the other users may be able to run:

$ ls /home/me/project/confidential
ls: cannot open directory '/home/me/project/confidential': Permission denied
$ ls /home/me/project/other
ls: cannot access '/home/me/project/other': No such file or directory

So, even this solution may not be perfect, because the other users may be able to determine the name of the hidden directory by trial and error.