5

For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file

A non-root user can techincally read that file but in practice to read it the process must be given the pathname to the file, and the kernel will check that the directory /test has the executable bit set. Because it is not set, the read will fail.

If the one does a chmod o+x /test, then a non-root user can do a cat /test/file and read the file. Is there a way to read the file without setting the execute bit on the directory /test.? For example, could one somehow pass the file to the fopen function in C without giving it the full pathname. You could if the process was running the test dir, but to be in that dir it would need the right permissions anyway.

Improve this question
7
  • Are you asking about vulnerabilities that would allow a user to bypass directory traverse checking on a running system, intricacies of Linux access control (which can get far more elaborate than the standard POSIX permission bits), ways that somebody could get around permission checks entirely without exploiting a software vuln, or something else like that?
    – CBHacking
    Aug 12, 2020 at 8:52
  • Yeah - specifically if the directory check can be bypased when given the pathname to the file.
    – sashang
    Aug 12, 2020 at 22:40
  • If the directory has not the x bit set (for the current user of the process), it will not be possible to open the file. Among the workarounds I can think of, you could use a hard link in a directory having the x bit set.
    – Serge Ballesta
    May 10, 2021 at 10:34
  • @SergeBallesta well yes, if you have the R bit set for file for others, you can read the file with a direct inode open or a hard link or symlink. It won’t work if you have to traverse the directory but if you can bypass the directory traversal you actually have access.
    – LvB
    Jan 5, 2022 at 9:18
  • The first thing I would test is path traversal and getting there using some combination of . and .. as those are often overlooked in terms of permissions.
    – nethero
    Jan 5, 2022 at 9:40

1 Answer 1

Reset to default
-1

If there exists a symlink to the file that is inside an executable directory, the user can still read the symlink, regardless of its type. I'm uncertain whether there are other known methods.

Improve this answer
3
  • if the exec bit is set then yes a symlink to it would work. but the question is asking if there is a way to read the file without the exec bit set on the directory.
    – sashang
    Aug 13, 2020 at 5:18
  • @sashang And I am saying that you can indeed access those symlinks, even if the containing directory for the file that symlink points to doesn't have the exec bit. At least that works on my machine.
    – Dean Valentine
    Aug 13, 2020 at 7:04
  • When I tested I created a symlink to a file in the directory. The directory did not have the other exec bit set. The file had the other read bit set. I tried to read the symlink and got a permission denied.
    – sashang
    Aug 13, 2020 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.