Messages in this thread | | | Subject | Re: File Permissions are incorrect. Security flaw in Linux | From | Mathieu Chouquet-Stringer <> | Date | 01 Oct 2003 09:08:30 -0400 |
| |
lisanels@cableone.net ("Lisa R. Nelson") writes: > [1.] One line summary of the problem: > A low level user can delete a file owned by root and belonging to group > root even if the files permissions are 744. This is not in agreement > with Unix, and is a major security issue.
That's perfectly normal, the directory where you put your files is writable by anyone and that's what matters. To remove a file, you don't need permission on the file but on the container, which is the directory in your case. Make the directory 1777 instead of 777 or try the same thing under /tmp.
-- Mathieu Chouquet-Stringer E-Mail : mathieu@newview.com Never attribute to malice that which can be adequately explained by stupidity. -- Hanlon's Razor -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |