lkml.org 
[lkml]   [2003]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: File Permissions are incorrect. Security flaw in Linux
On Wed, 1 Oct 2003, Jurjen Oskam wrote:

> On Wed, Oct 01, 2003 at 06:40:13AM -0600, Lisa R. Nelson wrote:
>
> > [1.] One line summary of the problem:
> > A low level user can delete a file owned by root and belonging to group
> > root even if the files permissions are 744. This is not in agreement
> > with Unix, and is a major security issue.
>
> This *is* in agreement with Unix. It works exactly the same on AIX, for
> example.
>
> --
> Jurjen Oskam
>

Yes. File removal is subject to DIRECTORY permissions.

Script started on Wed Oct 1 10:03:26 2003
# pwd
/tmp
# >foo
# chmod 744 foo
# ls -la
total 8
drwxrwxrwx 2 root root 4096 Oct 1 10:03 .
drwxr-xr-x 25 root root 4096 Oct 1 04:09 ..
-rwxr--r-- 1 root root 0 Oct 1 10:03 foo
-rw-r--r-- 1 root root 0 Oct 1 10:03 typescript
# su johnson
$ ls -la
total 8
drwxrwxrwx 2 root root 4096 Oct 1 10:03 .
drwxr-xr-x 25 root root 4096 Oct 1 04:09 ..
-rwxr--r-- 1 root root 0 Oct 1 10:03 foo
-rw-r--r-- 1 root root 0 Oct 1 10:03 typescript
$ pwd
/tmp
$ rm foo
rm: remove write-protected file `foo'? y
$ ls -la
total 8
drwxrwxrwx 2 root root 4096 Oct 1 10:04 .
drwxr-xr-x 25 root root 4096 Oct 1 04:09 ..
-rw-r--r-- 1 root root 0 Oct 1 10:03 typescript
$ exit
exit
# ls
typescript
# exit
exit
Script done on Wed Oct 1 10:04:17 2003

...So anything you put into "/tmp", for instance, can be deleted
by anybody. This is the Unix way.


Cheers,
Dick Johnson
Penguin : Linux version 2.4.22 on an i686 machine (797.90 BogoMips).
Note 96.31% of all statistics are fiction.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.086 / U:0.348 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site