For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file

A non-root user can techincally read that file but in practice to read it the process must be given the pathname to the file, and the kernel will check that the directory /test has the executable bit set. Because it is not set, the read will fail.

If the one does a chmod o+x /test, then a non-root user can do a cat /test/file and read the file. Is there a way to read the file without setting the execute bit on the directory /test.? For example, could one somehow pass the file to the fopen function in C without giving it the full pathname. You could if the process was running the test dir, but to be in that dir it would need the right permissions anyway.

  • Are you asking about vulnerabilities that would allow a user to bypass directory traverse checking on a running system, intricacies of Linux access control (which can get far more elaborate than the standard POSIX permission bits), ways that somebody could get around permission checks entirely without exploiting a software vuln, or something else like that?
    – CBHacking
    Aug 12 '20 at 8:52
  • Yeah - specifically if the directory check can be bypased when given the pathname to the file.
    – sashang
    Aug 12 '20 at 22:40
  • If the directory has not the x bit set (for the current user of the process), it will not be possible to open the file. Among the workarounds I can think of, you could use a hard link in a directory having the x bit set. May 10 at 10:34

If there exists a symlink to the file that is inside an executable directory, the user can still read the symlink, regardless of its type. I'm uncertain whether there are other known methods.

  • if the exec bit is set then yes a symlink to it would work. but the question is asking if there is a way to read the file without the exec bit set on the directory.
    – sashang
    Aug 13 '20 at 5:18
  • @sashang And I am saying that you can indeed access those symlinks, even if the containing directory for the file that symlink points to doesn't have the exec bit. At least that works on my machine. Aug 13 '20 at 7:04
  • When I tested I created a symlink to a file in the directory. The directory did not have the other exec bit set. The file had the other read bit set. I tried to read the symlink and got a permission denied.
    – sashang
    Aug 13 '20 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.