Gfilui

Here's a glimpse at the permissions of files in my home directory:

664 -rw-rw-r-- bob:bob .bash_aliases
600 -rw------- bob:bob .bash_history
664 -rw-rw-r-- bob:bob .bash_login
644 -rw-r--r-- bob:bob .bash_logout
664 -rw-rw-r-- bob:bob .bash_profile
644 -rw-r--r-- bob:bob .bashrc
700 drwx------ bob:bob .cache
644 -rw-r--r-- bob:bob .cloud-locale-test.skip
700 drwx------ bob:bob .gnupg
400 -r-------- bob:bob .google_authenticator
644 -rw-r--r-- bob:bob .profile
700 drwx------ bob:bob .ssh
644 -rw-r--r-- bob:bob .sudo_as_admin_successful
600 -rw------- bob:bob .viminfo
664 -rw-rw-r-- bob:bob .vimrc

Here's what I want to change them to, as I have tested these permissions and they don't seem to hurt anything:

440 -r--r----- root:bob .bash_aliases
600 -rw------- bob:bob .bash_history
440 -r--r----- root:bob .bash_login
644 -rw-r--r-- bob:bob .bash_logout
440 -r--r----- root:bob .bash_profile
440 -r--r----- root:bob .bashrc
700 drwx------ bob:bob .cache
644 -rw-r--r-- bob:bob .cloud-locale-test.skip
700 drwx------ bob:bob .gnupg
400 -r-------- bob:bob .google_authenticator
440 -r--r----- root:bob .profile
700 drwx------ bob:bob .ssh
644 -rw-r--r-- bob:bob .sudo_as_admin_successful
600 -rw------- bob:bob .viminfo
440 -r--r----- root:bob .vimrc

In short, I've changed the user ownership of .profile, .bashrc, .bash_profile, .bash_login, .bash_aliases and .vimrc to root and changed the permissions to where only root and bob may read the files.

What I'm trying to do:
I'm setting the permissions this way so that if I walk away from my desk for a moment, a bad actor would need my sudo user password in order to change, add or remove anything in these dot files.

My concern/query:
Does any one know of cases, real or edge, where upgrading the system or installing a package would result in an error because these .dot files are not writable by sudo user bob? As far as I know, I have never seen a package installation or upgrade that resulted in changes to these dot files (which isn't to say it hasn't happened and I missed it). In particular, my concern is about .profile and .bashrc. The other files aren't even there on a fresh installation of Ubuntu 16.04 or 18.04.

It's also possible there are negative implications to what I want do that have nothing to do with package management, although for the life of me I can't think of any other scenario where hardening permissions on .bashrc and .profile would cause a problem.

... a bad actor would need my sudo user password in order to change, add or remove anything in these dot files.

False. If your home directory is writable by you (which it likely is, and which you likely want to keep that way), anybody who can run commands as your user can delete or rename them, and create a files in their place.

That could be worked around by making it immutable, though.

That said, packages from the official repositories are not allowed to directly mess with user home directories. You're safe on that count. If you download random debs from elsewhere, they may or may not make assumptions about your home directories - there's no telling.