Questions tagged [permissions]

Access control based on user, group, or global access.

1
vote
0answers
30 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
1
vote
2answers
87 views

Is it ok to allow a web application to write its own executable files?

Usually I setup my Ubuntu server to have at least 2 users: A user behalf which the web server (Apache or Nginx) runs, e.g. www-data in group www-data A user that updates and maintains the web ...
39
votes
8answers
10k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
0
votes
0answers
28 views

Development and Production on the same RDS instance, but under different databases?

I was told to create a single RDS instance (amazon web services RDS) onto which I should create two users, development and production, and two databases, development and production. The idea is that ...
2
votes
1answer
67 views

Amazon Web Services ELB has permission to change DNS records by default?

I'm creating an ECS (Elastic Container Service) service on AWS. For that service, I need to supply an application load balancer. The default role for it is the following: AWSServiceRoleForECS. When I ...
0
votes
1answer
53 views

Risk associated with problematic linux permissions on files and libraries

I started tweaking my linux system a while ago, before I understood the security risks related to having files with problematic permissions, such as 777. I wanted to check if I had left some ...
1
vote
1answer
83 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
2
votes
1answer
238 views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
1
vote
2answers
102 views

Doubt on Android permissions mapping with UIDs/GIDs

Reading the book: Android Security Internals I'm reading at Chapter 2 - Permission Management paragraph that permissions are assigned to application at install time by the packet manager with a ...
0
votes
0answers
20 views

can't find mapping of “android.permission.INTERNET” permission to famous methods which should use it

I was trying to evaluate effective permissions usage of an apk using axplorer mapping files. During evaluation I obtained an effective use of the android.permission.INTERNET permission equal to 0. ...
1
vote
1answer
43 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
11
votes
2answers
223 views

Is there always a user notification when smartphones record audio?

Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
2
votes
0answers
81 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
2
votes
0answers
57 views

Is it secure to give sitemap.xml 777 permission?

One of my colleagues told me to change the permissions of the sitemap.xml to 777 by using chmod 0777. Is this secure? The sitemap.xml is inside a media folder where our marketing team has access to ...
3
votes
1answer
93 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
0
votes
1answer
37 views

How do I need to secure my Windows Shares?

I am working on an Domain Controller / File Server on Windows Server 2012. Lets say that I am from a school and that I have 3 OU's (or security groups) Students Staff IT When I create a shared ...
2
votes
2answers
245 views

Can a website see the file location of a document I upload?

While applying to a job, I uploaded a resume to a recruiting website: C:\myname\an\embarrassing\path\to\my\resume.pdf Can the website see the file path of my uploaded document?
1
vote
2answers
38 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
1
vote
1answer
69 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
0
votes
1answer
120 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
1
vote
1answer
143 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
3
votes
2answers
176 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
0
votes
1answer
134 views

In apache, why www-data owner of a web application directory is safer than recursive 777?

I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep ...
0
votes
1answer
64 views

Read-only to the root user

Is there a permanent and secure (as in integrity) way to make the entire Ubuntu system of a VPS (virtual private server) read-only to all users (including the root user)?
11
votes
1answer
968 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
43
votes
3answers
6k views

Reason to not use chmod -R 777 on internal server for project source code?

From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it. I now work on a ...
3
votes
1answer
160 views

Weird group name ( 1002)

Please forgive me if this is the wrong place to ask this, but I ran ls -l on an ubuntu machine today in /etc and found a few entries like the following middle entry which appears to have spaces in ...
1
vote
2answers
82 views

An application started by the root user has root privileges?

I'm starting node.js on my server. I have to start the node.js HTTP server as root, because it will listen on the port 80. Once i start the node.js on port 80, if a person is able to execute some code ...
7
votes
1answer
258 views

Why would a banking app require access to browsing history and information about apps running on the device?

I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device. Why would a banking app ...
3
votes
0answers
82 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
0
votes
1answer
59 views

Is it safe to remove read-only attribute from wwwroot?

I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
3
votes
1answer
79 views

To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
0
votes
1answer
58 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
3
votes
2answers
2k views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
1
vote
1answer
64 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
4
votes
1answer
108 views

How to properly protect /home with separate user accounts on Linux

A great quote from this InfoSec stackExchange thread. The way to prevent malicious code from damaging files in your home directory is to not run it using your account. Create a separate_user ...
0
votes
2answers
60 views

Prevent program from switching to user without password

I created a user with useradd without specifying a password. When I try to sudo -u theuser echo hi I am being prompted for my admin password (unless specified otherwise in the sudoers file, of ...
3
votes
1answer
79 views

Hiring a Third Party Developer, what config files & certificates are ok to share?

So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
99
votes
13answers
14k views

Why is root security enforced but $HOME typically unprotected?

Coming from the comments in this question Why is it bad to log in as root?: The sudo mechanics is in use so non-administrative tools "cannot harm your system." I agree that it would be pretty bad if ...
3
votes
2answers
123 views

How do companies manage resources shared with 3rd parties on cloud platforms?

Over the years people at my company have shared resources on cloud platforms with 3rd many parties. This can be files on Google Drive, articles on Confluence, repositories on Github, slack channels, ...
4
votes
2answers
358 views

Local admin permissions for MMC

Do I really need local admin permissions on my own laptop on order to access MMC to check/verify things like asset ownership for a certain object, group structure, etc ? On the internet found ...
3
votes
2answers
2k views

Where are NTFS security ACLs stored on Windows systems?

Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
1
vote
1answer
964 views

How to find an appropriate SELinux type to prevent “permission denied”

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
2
votes
2answers
599 views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
3
votes
4answers
214 views

How To give someone a shell in my local net without security risks?

I have a server A in my local network in my house. I want to allow someone to come to that server using a reverse ssh connection from my server to his server from which he can get to my server. I don'...
2
votes
2answers
335 views

Are there potentential risks to allowing a PHP website MySQL User to have Create, Alter, and Drop Permissions

Let me prefix my question with some information on our environment. We have a web server with 100+ websites. The web server has a corresponding MySQL Server version 5.7. Each PHP website has MySQL ...
2
votes
2answers
928 views

Debugging SUID for privilege escalation

When doing privilege escalation, assuming an application with the SUID set and a debugger, what stops us from starting a shell from within the debugger? I mean just write the shell code in an ...
7
votes
0answers
464 views

Separating “function” from “scope” in RBAC

I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which ...
0
votes
1answer
72 views

Proper way to protect a logs directory

When hardening a WAS (in this case I am using Tomcat), OWASP recommends to apply this Linux permissions to the logs directory: Make sure tomcat user has read/write access to /tmp and write (300 - ...
1
vote
1answer
65 views

Remote Worker Sharepoint Access Permissions

Here is the problem encountered at my company: We have set of very disorganized files on a Microsoft Sharepoint server I have one person going through and reorganizing everything. In terms of ...