Access control based on user, group, or global access.

learn more… | top users | synonyms

46
votes
6answers
11k views

Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it?

The unix read permission is actually the same as the execute permission, so if e.g. one process has write access it's also able to execute the same file. This can be done pretty easily:First this ...
39
votes
6answers
4k views

Why do mobile apps have fine-grained permissions while desktop apps don't? [duplicate]

Androids apps use fine-grained permissions for security reasons, iOS apps (afaik) do it as well. Windows 8.1 applications don't have a permission schema like that, all Linux versions which I have ...
36
votes
1answer
30k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
26
votes
1answer
5k views

Why do you have to be an admin to create a symlink in Windows?

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
18
votes
6answers
4k views

Why is it considered safe to install something as a non-root user in Linux environments?

We always hear it is safe to run unknown programs as non-root users in Linux because non-root users are sandboxed from the system level and can't change anything out of their permission scope. If ...
17
votes
3answers
2k views

Is hacking legal when a friend allows you to attempt to hack their system?

So I've begun learning to penetration test and I want to try it on a real system, (apart from my own), and so I have asked a friend if I can hack their computer. He is as interested as I am on the ...
15
votes
6answers
11k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
14
votes
2answers
3k views

Security implications of having files owned by the apache user?

Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario: Multiple developers need access to create and modify files under ...
13
votes
4answers
750 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...
13
votes
2answers
2k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
12
votes
4answers
358 views

Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?

Background We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
11
votes
1answer
154 views

Why does Android mix phone state with phone identity?

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
8
votes
3answers
3k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
8
votes
2answers
290 views

What's ownership concept for?

I fail to grasp the necessity of using concept of owner (ownership) and find clear explanation of its necessity. What cannot be done without concept of owner(ownership) in filesystem/database object ...
8
votes
2answers
2k views

What are the dangers of storing webserver temp files in the /tmp/ folder?

I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files. This includes the body of http requests, proxy files etc. The /tmp ...
8
votes
1answer
261 views

What is your default umask set to?

What is your default umask set to? Did you run into any problem setting a stricter default umask?
8
votes
2answers
250 views

How do high-performance web applications control permission to their content?

So, I believe I understand the logic behind authorization standards like OAuth. The OAuth token contains information about the user (name, role, etc.), which I can use to secure my application. ...
8
votes
1answer
2k views

Security of IFTTT

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
7
votes
4answers
2k views

Does disabling .htaccess improve security?

I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it ...
7
votes
2answers
1k views

Can i compare linux user permissions without root access?

I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is ...
6
votes
2answers
810 views

What is the most appropriate way to notify/request permission from an ISP related to white-hat security testing?

In some of the posts I've read on this site such as Is hacking legal when a friend allows you to attempt to hack their system?, and Best way to test my home network from the outside, users who ...
6
votes
2answers
64 views

What kind of misconfiguration may lead to publicly accessible webserver logs?

While Googling for a few rare user agent strings and URL paths, I stumbled upon a few websites that have their webserver logs publicly accessible. Investigating further, I found that this is not an ...
6
votes
1answer
214 views

Linux - user can be in forbidden directory if su to it from user with access - is this concerning?

I was in a directory on CentOS as user1 (root in this case) and then did su to user2 which cannot normally get to that directory due to lack of "execute" permission on a parent directory, but as user2 ...
5
votes
2answers
122 views

Is there a reason why /proc/interrupts is world-readable?

Reading this recent research paper on how to use information from /proc/interrupts to attack a system, I was wondering whether there is a particular reason why /proc/interrupts is world-readable. ...
5
votes
1answer
424 views

What are the dangers with creating MySQL databases on the fly?

I am building a site where people set up small, private, social networks. For ease of administration and portability, I would like each network to be stored in a different MySQL database. I ...
5
votes
2answers
2k views

Are there any Windows permissions management applications?

I am currently dealing with permission issues with an IIS app pool. I am tired of clicking through window after window to set permissions on folders for domain and local users. Also, I would like ...
5
votes
1answer
107 views

How to grant permission to read a text file to a specific application run by a regular user?

A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can ...
5
votes
1answer
5k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
5
votes
2answers
158 views

Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?

There is a Android application Threema for communication encryption and that says it does not collect user data, but it requires the following permissions: identity, contacts and device ID. Can ...
5
votes
1answer
132 views

OpenBSD, fbtab and X Window [closed]

The afterboot(8) man page of OpenBSD advises "You might wish to tighten up security more by editing /etc/fbtab as when installing X. " I would like to know what entries in /etc/fbtab would make sense ...
4
votes
4answers
165 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
4
votes
1answer
169 views

Should I use sudo with the normal user or root or sudo with another user?

on a UNIX OS, ex.: OpenBSD (used as a desktop by me only), which one is the best choice in regards to security. I want to run desktop operations (like pkg_add) with root permissions. 1. having the ...
4
votes
4answers
878 views

What mechanism enforces user permissions in Unix/Linux?

One of the core pieces of security in Unix/Linux systems is limiting privileges by user. For instance, certain actions can only be done by the root user. In theory, this can keep a malicious process ...
4
votes
1answer
64 views

Are viewable permissions an issue?

Is it, generally, considered to be a security issue if a user in 3-tier application has read-only access to other users' permissions? I.e. Alice can see that Bob has or has not access to some ...
4
votes
1answer
45 views

Is protecting a parent folder secure enough to protect files within that folder?

So this topic came up during a hardening exercise on Unix/Linux machines where a parent folder was marked with chmod 740 but files within that folder were marked chmod 644, and the argument went that ...
4
votes
2answers
238 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (a wordpress site) for a friend got hacked and all php pages had added code at the bottom in the form of echo base64_encode(...);. Thus there were unwanted ads on very ...
4
votes
3answers
157 views

Does allowing everyone know when a server process was started pose a security risk?

I recently found that in Microsoft .NET framework an impersonated thread is not allowed to request "time at which the current process was started". This could be done intentionally or this could be ...
4
votes
1answer
711 views

Can UNIX Domain Sockets be locked by user ID?

If I created a folder /tmp/me with permissions 700, and started a process under me that starts a listen socket under /tmp/me/socket. I currently assume that a connection to that socket originated ...
3
votes
3answers
3k views

Disable Perl for some/most Linux users?

One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
3
votes
4answers
112 views

Does an editable file owned by root pose any risk?

On a Linux machine, if we allowed the user bob with home directory /home/bob to put any content (malicious or not) into the file /home/bob/dangerfile.txt -rw-r--r-- 1 root root 61K Aug 24 13:59 ...
3
votes
2answers
255 views

What are the security risks in leaving 'sudo' inside my production code?

I have a script that can only run successfully with root permissions But in development it's really hard to run with root permissions (in my development environment) so I add 'sudo' when ever it's ...
3
votes
4answers
331 views

How to give rights to a System Administrator in an application?

I am designing a security model for a web application which restricts access to certain parts of the app depending on what rights and permissions the user has. These rights and permissions are grouped ...
3
votes
5answers
2k views

Security purpose of asking admin password to mount partition on Linux

So I divided my 250GB laptop drive into 2 partitions and some swap. On the second partition which is an ext4 60GB partition I installed Fedora 17. On the other bigger NTFS partition I've got Win XP ...
3
votes
3answers
45 views

Is there a reason to create a database user without schema privileges?

One of the common things seen people setup is database users (for use by an actual application) that only have SELECT/UPDATE/INSERT/DELETE permissions. A separate user (that additionally has ...
3
votes
1answer
2k views

Which Domain Administrator created file X on a Windows 2008 R2-based server?

Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file? The creator/owner says "Domain Administrators". ...
3
votes
1answer
149 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
3
votes
3answers
2k views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
2
votes
3answers
2k views

How can winlock virus change Windows Registry without admin permission?

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command. So I'm interested in how does this virus works. How can it edit ...
2
votes
2answers
305 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
2
votes
1answer
936 views

Can suPHP lead to security issues due to hijacking people's accounts?

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on ...