Can I rely on the 701 permissions to prevent users within the same group from messing with each other's data?

Some time ago I've learned that assigning all users to the same group and setting 701 to their home directories prevents them from messing with each other's data, yet lets a system program, such as a web-server, to access the data.

So I create a group users then two users, alice:users and bob:users with /opt/www/alice and /opt/www/bob home directories respectively. Then, after logging under alice I am unable to enter /opt/www/bob and vice versa.

So it seems to me that permissions aren't always checked for the every type (user, group, everyone) but rather gradually, essentially stopping after a negative match. I.e, in my case

• when a user from the same group tries to open the directory:
  • first, we are checking a user, it is not the same but 7 let us go further
  • then 0 stops us from accessing the the directory and also stops the further permissions checking
  • so we don't fall into x-for-everyone case from 1
• while for a user from the the different group:
  • first, we are checking a user, it is not the same but 7 let us go further
  • then we are checking for a group, it is 0 but the group is different, so it let's us pass
  • so we're able to open the directory thanks to 1 being "everyone" to this directory

Is this conjecture correct? Can I rely on this behavior? What are possible downsides from this setup?

I think you've got it slightly wrong, but the outcome is the same. 701 means that:

• the user marked as owner gets full permissions, 7
• a user in the group marked as the group owner gets no permissions, 0
• everyone gets execute permissions, 1

So if the owner & permissions on /opt/www/bob are bob:users and 701 respectively, then bob gets full permissions and everyone can 'execute' the directory. This means anyone would be able to access their own files or group owned files within the folder, but they can't list the contents.

Example:

$> mkdir test
$> echo 'foo' > test/foo.txt
$> chmod 100 test/
$> ls -l test/
Permission denied
$> cat test/foo.txt
foo
$>

So yes, other users in the group would have no permissions, but everyone has execute permissions. You'd be better to set the permissions to 740 if you want to allow the group to read and no one else. Or 741 to achieve what you have, but be a bit clearer?