Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [permissions]

Access control based on user, group, or global access.

1
vote
1answer
66 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
1
vote
1answer
59 views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
1
vote
2answers
55 views

Doubt on Android permissions mapping with UIDs/GIDs

Reading the book: Android Security Internals I'm reading at Chapter 2 - Permission Management paragraph that permissions are assigned to application at install time by the packet manager with a ...
0
votes
0answers
18 views

can't find mapping of “android.permission.INTERNET” permission to famous methods which should use it

I was trying to evaluate effective permissions usage of an apk using axplorer mapping files. During evaluation I obtained an effective use of the android.permission.INTERNET permission equal to 0. ...
1
vote
1answer
30 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
11
votes
2answers
212 views

Is there always a user notification when smartphones record audio?

Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
2
votes
0answers
76 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
2
votes
0answers
39 views

Is it secure to give sitemap.xml 777 permission?

One of my colleagues told me to change the permissions of the sitemap.xml to 777 by using chmod 0777. Is this secure? The sitemap.xml is inside a media folder where our marketing team has access to ...
3
votes
1answer
88 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
0
votes
1answer
34 views

How do I need to secure my Windows Shares?

I am working on an Domain Controller / File Server on Windows Server 2012. Lets say that I am from a school and that I have 3 OU's (or security groups) Students Staff IT When I create a shared ...
2
votes
2answers
198 views

Can a website see the file location of a document I upload?

While applying to a job, I uploaded a resume to a recruiting website: C:\myname\an\embarrassing\path\to\my\resume.pdf Can the website see the file path of my uploaded document?
1
vote
2answers
37 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
1
vote
1answer
58 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
0
votes
1answer
88 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
1
vote
1answer
104 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
3
votes
2answers
150 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
0
votes
1answer
97 views

In apache, why www-data owner of a web application directory is safer than recursive 777?

I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep ...
0
votes
1answer
60 views

Read-only to the root user

Is there a permanent and secure (as in integrity) way to make the entire Ubuntu system of a VPS (virtual private server) read-only to all users (including the root user)?
12
votes
1answer
957 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
44
votes
3answers
6k views

Reason to not use chmod -R 777 on internal server for project source code?

From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it. I now work on a ...
3
votes
1answer
127 views

Weird group name ( 1002)

Please forgive me if this is the wrong place to ask this, but I ran ls -l on an ubuntu machine today in /etc and found a few entries like the following middle entry which appears to have spaces in ...
1
vote
2answers
74 views

An application started by the root user has root privileges?

I'm starting node.js on my server. I have to start the node.js HTTP server as root, because it will listen on the port 80. Once i start the node.js on port 80, if a person is able to execute some code ...
7
votes
1answer
251 views

Why would a banking app require access to browsing history and information about apps running on the device?

I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device. Why would a banking app ...
3
votes
0answers
79 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
0
votes
0answers
35 views

Is it safe to remove read-only attribute from wwwroot?

I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
3
votes
1answer
71 views

To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
0
votes
0answers
20 views

Determine location of binary reference in macOS keychain dialog

Here is an example dialog: In this example, I am fairly certain that the binary security is the one located at /usr/bin/security, but how can I be sure? The ? button simply brings up a Mac Help ...
0
votes
1answer
57 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
3
votes
2answers
1k views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
1
vote
1answer
57 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
4
votes
1answer
95 views

How to properly protect /home with separate user accounts on Linux

A great quote from this InfoSec stackExchange thread. The way to prevent malicious code from damaging files in your home directory is to not run it using your account. Create a separate_user ...
0
votes
2answers
58 views

Prevent program from switching to user without password

I created a user with useradd without specifying a password. When I try to sudo -u theuser echo hi I am being prompted for my admin password (unless specified otherwise in the sudoers file, of ...
3
votes
1answer
79 views

Hiring a Third Party Developer, what config files & certificates are ok to share?

So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
98
votes
13answers
14k views

Why is root security enforced but $HOME typically unprotected?

Coming from the comments in this question Why is it bad to log in as root?: The sudo mechanics is in use so non-administrative tools "cannot harm your system." I agree that it would be pretty bad if ...
3
votes
2answers
118 views

How do companies manage resources shared with 3rd parties on cloud platforms?

Over the years people at my company have shared resources on cloud platforms with 3rd many parties. This can be files on Google Drive, articles on Confluence, repositories on Github, slack channels, ...
4
votes
2answers
300 views

Local admin permissions for MMC

Do I really need local admin permissions on my own laptop on order to access MMC to check/verify things like asset ownership for a certain object, group structure, etc ? On the internet found ...
3
votes
2answers
2k views

Where are NTFS security ACLs stored on Windows systems?

Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
1
vote
1answer
843 views

How to find an appropriate SELinux type to prevent “permission denied”

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
2
votes
2answers
518 views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
3
votes
4answers
211 views

How To give someone a shell in my local net without security risks?

I have a server A in my local network in my house. I want to allow someone to come to that server using a reverse ssh connection from my server to his server from which he can get to my server. I don'...
2
votes
2answers
306 views

Are there potentential risks to allowing a PHP website MySQL User to have Create, Alter, and Drop Permissions

Let me prefix my question with some information on our environment. We have a web server with 100+ websites. The web server has a corresponding MySQL Server version 5.7. Each PHP website has MySQL ...
2
votes
2answers
772 views

Debugging SUID for privilege escalation

When doing privilege escalation, assuming an application with the SUID set and a debugger, what stops us from starting a shell from within the debugger? I mean just write the shell code in an ...
5
votes
0answers
396 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
0
votes
1answer
67 views

Proper way to protect a logs directory

When hardening a WAS (in this case I am using Tomcat), OWASP recommends to apply this Linux permissions to the logs directory: Make sure tomcat user has read/write access to /tmp and write (300 - ...
1
vote
1answer
61 views

Remote Worker Sharepoint Access Permissions

Here is the problem encountered at my company: We have set of very disorganized files on a Microsoft Sharepoint server I have one person going through and reorganizing everything. In terms of ...
59
votes
9answers
11k views

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

There has been a post on Niebezpiecznik.pl, a popular InfoSec blog, describing an interesting situation. A company mistakenly granted access to their BitBucket repo to a a random programmer. This ...
0
votes
1answer
289 views

Password write protect an external hard drive (DOK) without encryption [duplicate]

I'm handing out a usb sticks to students and want them to return after they copied the material to their personal computers. I want to make sure the usb's return without any damage/malware (...
0
votes
1answer
68 views

Messenger and Facebook photo access privacy

Does turning on "photo access permissions" for the Messenger or Facebook app on IOS/Android allow them to download the whole phone's photo gallery on Facebook’s servers? Do they do that?
2
votes
2answers
3k views

What is the difference between Right and Permission?

I know that the term "rights" applies to users or groups of users (such as "the user X has the right to change system time") and the term "permissions" applies to an object (such as a folder or file, ...
1
vote
3answers
155 views

Serving a local debug apache site from home directory requires 755 perms on directory tree, is this safe on a single-user laptop?

I have a few simple web apps deployed on external providers. For testing and debugging I run local instances (on-demand basis, not all the time) on localhost:80 using apache. These are hosted ...