Questions tagged [permissions]

Access control based on user, group, or global access.

Filter by
Sorted by
Tagged with
3
votes
2answers
75 views

How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?

We're currently redesigning our access control system for our SaaS startup (over the past two years it has grown alongside the business and decided to clean it up at this point). The access control ...
1
vote
0answers
31 views

How do you lock down a users access to ODBC settings in Windows 10?

I was working with a users computer yesterday because they complained that an MS-Access Database they were using said that an ODBC datasource was not accessible. I went to change the settings on the ...
1
vote
0answers
28 views

Securing multiple systems accessing the same data

I'm hitting a roadblock when it comes to security for managing scoped permissions for servers. Right now I run a community which can create sub-servers. So community A can allow certain users to ...
2
votes
3answers
103 views

Can an app access location services when I turn off location services?

An app I'm using requires me to grant it the permission to track my location, which I grant. But, if I manually toggle off the device's location service (for example in the settings or the drop down ...
0
votes
3answers
106 views

Is it safe to protect the write permission only with a publicly accessible hashed password?

A user stores a raw information (a comment on a website, a like on a post etc.) in a database. He pairs it with a hashed password and keep the original password safely for him/herself. This password ...
0
votes
0answers
43 views

Identifying Share Permission and File Permission on Hundreds of Servers

Objective Identify and report on Windows hosts in the network which allow file/folder access (READ/WRITE/Execute) for Everyone. Scenario: Using agent based scanner, I extracted share permissions ...
1
vote
1answer
97 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
1
vote
2answers
94 views

Is it ok to allow a web application to write its own executable files?

Usually I setup my Ubuntu server to have at least 2 users: A user behalf which the web server (Apache or Nginx) runs, e.g. www-data in group www-data A user that updates and maintains the web ...
39
votes
8answers
10k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
0
votes
0answers
32 views

Development and Production on the same RDS instance, but under different databases?

I was told to create a single RDS instance (amazon web services RDS) onto which I should create two users, development and production, and two databases, development and production. The idea is that ...
2
votes
1answer
69 views

Amazon Web Services ELB has permission to change DNS records by default?

I'm creating an ECS (Elastic Container Service) service on AWS. For that service, I need to supply an application load balancer. The default role for it is the following: AWSServiceRoleForECS. When I ...
0
votes
1answer
56 views

Risk associated with problematic linux permissions on files and libraries

I started tweaking my linux system a while ago, before I understood the security risks related to having files with problematic permissions, such as 777. I wanted to check if I had left some ...
1
vote
1answer
103 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
2
votes
1answer
532 views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
1
vote
2answers
140 views

Doubt on Android permissions mapping with UIDs/GIDs

Reading the book: Android Security Internals I'm reading at Chapter 2 - Permission Management paragraph that permissions are assigned to application at install time by the packet manager with a ...
0
votes
0answers
28 views

can't find mapping of “android.permission.INTERNET” permission to famous methods which should use it

I was trying to evaluate effective permissions usage of an apk using axplorer mapping files. During evaluation I obtained an effective use of the android.permission.INTERNET permission equal to 0. ...
1
vote
1answer
65 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
11
votes
2answers
234 views

Is there always a user notification when smartphones record audio?

Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
2
votes
0answers
92 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
2
votes
0answers
86 views

Is it secure to give sitemap.xml 777 permission?

One of my colleagues told me to change the permissions of the sitemap.xml to 777 by using chmod 0777. Is this secure? The sitemap.xml is inside a media folder where our marketing team has access to ...
3
votes
1answer
100 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
0
votes
1answer
43 views

How do I need to secure my Windows Shares?

I am working on an Domain Controller / File Server on Windows Server 2012. Lets say that I am from a school and that I have 3 OU's (or security groups) Students Staff IT When I create a shared ...
2
votes
2answers
310 views

Can a website see the file location of a document I upload?

While applying to a job, I uploaded a resume to a recruiting website: C:\myname\an\embarrassing\path\to\my\resume.pdf Can the website see the file path of my uploaded document?
1
vote
2answers
40 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
1
vote
1answer
70 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
0
votes
1answer
142 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
2
votes
1answer
210 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
3
votes
2answers
207 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
0
votes
1answer
214 views

In apache, why www-data owner of a web application directory is safer than recursive 777?

I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep ...
0
votes
1answer
68 views

Read-only to the root user

Is there a permanent and secure (as in integrity) way to make the entire Ubuntu system of a VPS (virtual private server) read-only to all users (including the root user)?
11
votes
1answer
986 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
45
votes
3answers
7k views

Reason to not use chmod -R 777 on internal server for project source code?

From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it. I now work on a ...
3
votes
1answer
228 views

Weird group name ( 1002)

Please forgive me if this is the wrong place to ask this, but I ran ls -l on an ubuntu machine today in /etc and found a few entries like the following middle entry which appears to have spaces in ...
1
vote
2answers
90 views

An application started by the root user has root privileges?

I'm starting node.js on my server. I have to start the node.js HTTP server as root, because it will listen on the port 80. Once i start the node.js on port 80, if a person is able to execute some code ...
7
votes
1answer
269 views

Why would a banking app require access to browsing history and information about apps running on the device?

I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device. Why would a banking app ...
3
votes
0answers
87 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
0
votes
1answer
60 views

Is it safe to remove read-only attribute from wwwroot?

I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
3
votes
1answer
85 views

To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
0
votes
1answer
61 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
3
votes
2answers
2k views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
1
vote
1answer
83 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
4
votes
1answer
126 views

How to properly protect /home with separate user accounts on Linux

A great quote from this InfoSec stackExchange thread. The way to prevent malicious code from damaging files in your home directory is to not run it using your account. Create a separate_user ...
0
votes
2answers
61 views

Prevent program from switching to user without password

I created a user with useradd without specifying a password. When I try to sudo -u theuser echo hi I am being prompted for my admin password (unless specified otherwise in the sudoers file, of ...
3
votes
1answer
79 views

Hiring a Third Party Developer, what config files & certificates are ok to share?

So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
99
votes
13answers
14k views

Why is root security enforced but $HOME typically unprotected?

Coming from the comments in this question Why is it bad to log in as root?: The sudo mechanics is in use so non-administrative tools "cannot harm your system." I agree that it would be pretty bad if ...
3
votes
2answers
123 views

How do companies manage resources shared with 3rd parties on cloud platforms?

Over the years people at my company have shared resources on cloud platforms with 3rd many parties. This can be files on Google Drive, articles on Confluence, repositories on Github, slack channels, ...
4
votes
2answers
419 views

Local admin permissions for MMC

Do I really need local admin permissions on my own laptop on order to access MMC to check/verify things like asset ownership for a certain object, group structure, etc ? On the internet found ...
3
votes
2answers
2k views

Where are NTFS security ACLs stored on Windows systems?

Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
2
votes
1answer
1k views

How to find an appropriate SELinux type to prevent “permission denied”

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
2
votes
2answers
684 views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...