22

Before uploading a photo or image to a forum, I may typically strip the metadata to remove identifying material with exiftool. The thing is, the Linux file system itself seems to leave some metadata on a file:

cardamom@pluto ~ $ ls -la
insgesamt 1156736
drwx------ 145 cardamom cardamom      20480 Mär 16 08:58  .
drwxr-xr-x   9 root  root        4096 Apr 21  2021  ..
-rw-r--r--   1 cardamom cardamom     123624 Mai 24  2018  IMG_20200627_215609.jpg

So I feel tempted to change the user and group of a file as well. Is that a good idea? There is always a user called nobody and a group called nogroup who look like they were almost made for the purpose.

Is that everything or is there more metadata that Linux is leaving on its files?

Improve this question
6
  • 39
    "There is always a user called nobody and a group called nogroup who look like they were almost made for the purpose.." – They are made for the exact opposite purpose. No file or directory should be owned by them. The purpose of them is that you can run a server or program under those IDs and be 100% sure that the server cannot access anything in the filesystem because there is nothing owned by it. (More precisely, that it can only access anything in the filesystem which is already world-readable).
    – Jörg W Mittag
    Mar 17, 2022 at 6:46
  • systemd-homed stores files on disk as nobody:nogroup and maps them to your user id when you login using namespaces. So it's not that you shouldn't store files owned by nobody. You can't depend on user IDs alone for that sort of protection.
    – Ananth
    Mar 18, 2022 at 2:45
  • 1
    @Ananth: Wow, if that's true it's a huge vuln - your files would be accessible to other users and to compromised daemons running as nobody. Do you have a citation for the claim?
    – R.. GitHub STOP HELPING ICE
    Mar 18, 2022 at 14:54
  • Ok @JörgWMittag I won't then bother with sudo chown nobody:nogroup IMG_20200627_215609.jpg before it uploading it as 'cardamom' will not be uploaded with the photo anyway by the sounds of it
    – cardamom
    Mar 18, 2022 at 20:25
  • 1
    @R..GitHubSTOPHELPINGICE the files are stored in an encrypted LUKS container first, and projected as the logged in user using user namespaces. My larger point is that user namespaces means that its quite safe to have nobody:nogroup own files as long as your architecture is sound.
    – Ananth
    Mar 19, 2022 at 15:52

2 Answers 2

Reset to default
64

the linux file system itself seems to leave some metadata on a file

User, group etc are meta data stored in the file system. They are not part of the file and thus will not be included when uploading the file in the browser.

This can be different in other data transfer method though. When copying or moving files between local file systems or remote file systems (NFS, SMB, ...), information like user, group and permissions might be transferred. They might also be included when storing the file in archives: some formats like Tar or Cpio include permissions and user and group id or even names.

Improve this answer
12
  • 4
    Unless you use a upload protocol which can transfer this meta-data (like rsync, sftp, SMB, WebDAV. AFP or nfs to some extend). I think JS/WebBrowser does not have that ability.
    – eckes
    Mar 17, 2022 at 7:25
  • 7
    @eckes: I think what you describe is not commonly referred to as "uploading" but as a transfer of data between file systems (i.e. copy, move, ...). In this case meta information at the file system level like ownership and permissions might be transferred and this might even be the expected behavior.
    – Steffen Ullrich
    Mar 17, 2022 at 7:31
  • 2
    @eckes: I've extended the answer to make more clear where these information get included and where not.
    – Steffen Ullrich
    Mar 17, 2022 at 9:08
  • 2
    Tar and cpio both store uid/gid information. user and group names are not stored in the archive.
    – doneal24
    Mar 17, 2022 at 15:02
  • 6
    Tar actually does store user name in the archive. You need to use the flag --numeric-owner if you want it to store just the UID/GID. Run mkdir foo && tar c foo | hexdump -C and you'll see your user and group names stored in the archive as ASCII. Tested on GNU tar 1.30.
    – forest
    Mar 17, 2022 at 22:37
14

An important piece of metadata you seem to forget is the file name: it is accessible to the JS in the browser, and from a name like IMG_20200627_215609.jpg one can deduce when the photo was taken even if you remove the EXIF.

If you don't trust the website you're uploading the photos to, you should consider renaming your files to something like image1.jpg before uploading.

Improve this answer
1
  • 1
    It's also accessible directly on the server once the file is uploaded, not just in javascript. In fact, the protocol supports giving the full path to the file, but modern browsers provide a fake path instead, which is always the same
    – TRiG
    Mar 21, 2022 at 16:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .