3

So this topic came up during a hardening exercise on Unix/Linux machines where a parent folder was marked with chmod 740 but files within that folder were marked chmod 644, and the argument went that we don't need to change permissions of the files within the protected folder because users can't cd to the directory to see the files within that directory. I wasn't convinced this meant they were secure. In what ways could those files be exposed to a user that wasn't supposed to have access?

  • You would have to check if you can access the files when they are in use by an application by going to /proc/[pid]/fd/. I currently have only a system with grsecurity enabled which doesn't allow me access to this folder if I'm not root or the process owner. – user2313067 Dec 2 '15 at 21:28
3

There is an excellent answer for this question on SE Unix & Linux.

In short, and to quote the answer:

The precise rule is: you can traverse a directory if and only if you have execute permission on it.

  • I guess that means I can rest more easily should something or someone screw up the permission with the folder I'm not going to be compromised because of it. – chubbsondubs Dec 2 '15 at 22:00
  • I am not sure I understood your comment by if you control the directory then you can ensure the safety of the files within, no matter the rights set on them. – WoJ Dec 2 '15 at 22:11
  • 1
    Well we were talking about if I deny you the ability to a higher level folder then the looser permissions below that folder won't allow someone to access that file because the parent folder prevents them. So if an admin or a program doesn't get the permissions just right it won't compromise security so long as that parent folder denies people. That is somewhat comforting. – chubbsondubs Dec 2 '15 at 23:04
  • @chubbsondubs: exactly – WoJ Dec 3 '15 at 7:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.