Questions tagged [permissions]

Access control based on user, group, or global access.

Filter by
Sorted by
Tagged with
1
vote
0answers
52 views

Under what conditions can malware bypass macOS Catalina's permission system?

Catalina has some new security features which include System Preferences > Security & Privacy features, which requires apps to request access to specific computer functionality such as camera, ...
1
vote
1answer
77 views

Is there any reason why PHP files require write permissions?

Is there any reason why PHP files would require write access? (Excluding directories that need to be writable) I'm installing Magento via composer. They recommend the following permissions: cd /var/...
0
votes
1answer
59 views

Can a file be extracted from a folder with only execute permissions?

(Debian GNU/Linux) If a user only has execute +x access to a folder they can still cd and traverse into the folder but can't use many other commands that would read the contents of the folder or ...
1
vote
0answers
61 views

Will this SFTP setup successfully keep users from accessing other areas of the filesystem?

If the access is secured; users are chrooted in their home directory, and other security basics, how difficult is it for users to access other data on the server? Dedicated server Linux CentOS ftp ...
6
votes
1answer
127 views

Was granting myself this permission a security risk?

In a PowerShell script in Windows 10 Pro 64, I'm getting access-denied errors on several folders, such as: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content....
62
votes
6answers
9k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
0
votes
0answers
26 views

Apps removing their permissions in OAuth

We are designing a web application for a customer and the main use case is that users will be using the system for anywhere between a few days and a few months. The customer would like to offer users ...
4
votes
2answers
110 views

How to design an Access Control system that is quick to implement and understand, yet maintainable and flexible enough?

We're currently redesigning our access control system for our SaaS startup (over the past two years it has grown alongside the business and decided to clean it up at this point). The access control ...
1
vote
0answers
33 views

How do you lock down a users access to ODBC settings in Windows 10?

I was working with a users computer yesterday because they complained that an MS-Access Database they were using said that an ODBC datasource was not accessible. I went to change the settings on the ...
1
vote
0answers
28 views

Securing multiple systems accessing the same data

I'm hitting a roadblock when it comes to security for managing scoped permissions for servers. Right now I run a community which can create sub-servers. So community A can allow certain users to ...
2
votes
3answers
121 views

Can an app access location services when I turn off location services?

An app I'm using requires me to grant it the permission to track my location, which I grant. But, if I manually toggle off the device's location service (for example in the settings or the drop down ...
0
votes
3answers
108 views

Is it safe to protect the write permission only with a publicly accessible hashed password?

A user stores a raw information (a comment on a website, a like on a post etc.) in a database. He pairs it with a hashed password and keep the original password safely for him/herself. This password ...
0
votes
0answers
59 views

Identifying Share Permission and File Permission on Hundreds of Servers

Objective Identify and report on Windows hosts in the network which allow file/folder access (READ/WRITE/Execute) for Everyone. Scenario: Using agent based scanner, I extracted share permissions ...
1
vote
1answer
111 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
1
vote
2answers
97 views

Is it ok to allow a web application to write its own executable files?

Usually I setup my Ubuntu server to have at least 2 users: A user behalf which the web server (Apache or Nginx) runs, e.g. www-data in group www-data A user that updates and maintains the web ...
39
votes
8answers
10k views

How can I prevent a user from copying files to another hard drive?

I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
0
votes
0answers
37 views

Development and Production on the same RDS instance, but under different databases?

I was told to create a single RDS instance (amazon web services RDS) onto which I should create two users, development and production, and two databases, development and production. The idea is that ...
2
votes
1answer
76 views

Amazon Web Services ELB has permission to change DNS records by default?

I'm creating an ECS (Elastic Container Service) service on AWS. For that service, I need to supply an application load balancer. The default role for it is the following: AWSServiceRoleForECS. When I ...
0
votes
1answer
72 views

Risk associated with problematic linux permissions on files and libraries

I started tweaking my linux system a while ago, before I understood the security risks related to having files with problematic permissions, such as 777. I wanted to check if I had left some ...
1
vote
1answer
127 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
2
votes
1answer
1k views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
1
vote
2answers
170 views

Doubt on Android permissions mapping with UIDs/GIDs

Reading the book: Android Security Internals I'm reading at Chapter 2 - Permission Management paragraph that permissions are assigned to application at install time by the packet manager with a ...
0
votes
0answers
37 views

can't find mapping of “android.permission.INTERNET” permission to famous methods which should use it

I was trying to evaluate effective permissions usage of an apk using axplorer mapping files. During evaluation I obtained an effective use of the android.permission.INTERNET permission equal to 0. ...
1
vote
1answer
88 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
11
votes
2answers
243 views

Is there always a user notification when smartphones record audio?

Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
2
votes
0answers
112 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
2
votes
0answers
118 views

Is it secure to give sitemap.xml 777 permission?

One of my colleagues told me to change the permissions of the sitemap.xml to 777 by using chmod 0777. Is this secure? The sitemap.xml is inside a media folder where our marketing team has access to ...
4
votes
1answer
106 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
0
votes
1answer
71 views

How do I need to secure my Windows Shares?

I am working on an Domain Controller / File Server on Windows Server 2012. Lets say that I am from a school and that I have 3 OU's (or security groups) Students Staff IT When I create a shared ...
3
votes
2answers
407 views

Can a website see the file location of a document I upload?

While applying to a job, I uploaded a resume to a recruiting website: C:\myname\an\embarrassing\path\to\my\resume.pdf Can the website see the file path of my uploaded document?
1
vote
2answers
43 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
1
vote
1answer
80 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
0
votes
1answer
167 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
2
votes
1answer
328 views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
3
votes
2answers
253 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
0
votes
1answer
430 views

In apache, why www-data owner of a web application directory is safer than recursive 777?

I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep ...
0
votes
1answer
70 views

Read-only to the root user

Is there a permanent and secure (as in integrity) way to make the entire Ubuntu system of a VPS (virtual private server) read-only to all users (including the root user)?
11
votes
1answer
1k views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
45
votes
3answers
7k views

Reason to not use chmod -R 777 on internal server for project source code?

From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it. I now work on a ...
3
votes
1answer
328 views

Weird group name ( 1002)

Please forgive me if this is the wrong place to ask this, but I ran ls -l on an ubuntu machine today in /etc and found a few entries like the following middle entry which appears to have spaces in ...
1
vote
2answers
90 views

An application started by the root user has root privileges?

I'm starting node.js on my server. I have to start the node.js HTTP server as root, because it will listen on the port 80. Once i start the node.js on port 80, if a person is able to execute some code ...
7
votes
1answer
289 views

Why would a banking app require access to browsing history and information about apps running on the device?

I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device. Why would a banking app ...
3
votes
0answers
105 views

How can an organization manage permissions in a centralized way?

Almost all applications mantain the permissions with the application and have no way of having at least the roles outside the application. Is the only way to have centralized authentication but ...
0
votes
1answer
69 views

Is it safe to remove read-only attribute from wwwroot?

I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
3
votes
1answer
114 views

To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
0
votes
1answer
61 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
3
votes
2answers
3k views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
1
vote
1answer
121 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
4
votes
1answer
157 views

How to properly protect /home with separate user accounts on Linux

A great quote from this InfoSec stackExchange thread. The way to prevent malicious code from damaging files in your home directory is to not run it using your account. Create a separate_user ...
0
votes
2answers
63 views

Prevent program from switching to user without password

I created a user with useradd without specifying a password. When I try to sudo -u theuser echo hi I am being prompted for my admin password (unless specified otherwise in the sudoers file, of ...