Questions tagged [permissions]

Access control based on user, group, or global access.

Filter by
Sorted by
Tagged with
77 votes
1 answer
69k views

What is the difference between RBAC and DAC/ACL?

What are the benefits of each, and when should I choose one over the other? Are there situations where these should be merged? Do you have examples of common usages? And what about MAC, where ...
  • 72.4k
43 votes
6 answers
5k views

Why do mobile apps have fine-grained permissions while desktop apps don't? [duplicate]

Androids apps use fine-grained permissions for security reasons, iOS apps (afaik) do it as well. Windows 8.1 applications don't have a permission schema like that, all Linux versions which I have ...
  • 2,433
11 votes
2 answers
319 views

Is there always a user notification when smartphones record audio?

Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
  • 131
102 votes
13 answers
14k views

Why is root security enforced but $HOME typically unprotected?

Coming from the comments in this question Why is it bad to log in as root?: The sudo mechanics is in use so non-administrative tools "cannot harm your system." I agree that it would be pretty bad if ...
  • 1,032
63 votes
6 answers
31k views

Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it?

The unix read permission is actually the same as the execute permission, so if e.g. one process has write access it's also able to execute the same file. This can be done pretty easily:First this ...
63 votes
6 answers
10k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
30 votes
6 answers
41k views

Difference between Privilege and Permission

I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if ...
  • 4,784
27 votes
6 answers
7k views

Why is it considered safe to install something as a non-root user in Linux environments?

We always hear it is safe to run unknown programs as non-root users in Linux because non-root users are sandboxed from the system level and can't change anything out of their permission scope. If ...
  • 2,392
17 votes
3 answers
4k views

Is hacking legal when a friend allows you to attempt to hack their system? [closed]

So I've begun learning to penetration test and I want to try it on a real system, (apart from my own), and so I have asked a friend if I can hack their computer. He is as interested as I am on the ...
  • 171
15 votes
3 answers
18k views

Storing application secrets safely on Linux

I have an linux application that needs to read a secret to decrypt some data. The application also allows the users to change the encryption password during runtime. The application will run under a ...
  • 251
13 votes
4 answers
630 views

Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?

Background We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
  • 255
11 votes
1 answer
1k views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
  • 29.1k
5 votes
2 answers
324 views

Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?

There is a Android application Threema for communication encryption and that says it does not collect user data, but it requires the following permissions: identity, contacts and device ID. Can ...
  • 153
4 votes
1 answer
2k views

Which Domain Administrator created file X on a Windows 2008 R2-based server?

Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file? The creator/owner says "Domain Administrators". ...
2 votes
1 answer
672 views

Local Admin has Domain Admin rights

While installing a new XP machine that had not been connected to the domain I was browsing to a UNC path and was not prompted for authentication. I then went to the different mapped drives and found ...
2 votes
1 answer
1k views

Is there a list of safe/normal/expected SUID files?

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
2 votes
1 answer
477 views

Give only execute permissions to a Linux binary (prevent inspection)?

I'm writing an assignment for a security course, and I'm trying to create an executable which students can interact with (ie, execute), but not inspect. In particular what I'd like is for them to be ...
  • 123
2 votes
1 answer
2k views

How to find an appropriate SELinux type to prevent "permission denied"

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
  • 285
1 vote
0 answers
76 views

Clarification on log4j Service Requirements [duplicate]

We're currently trying to prioritize our mitigations for CVE-2021-44228. The obvious priority is to deal with any Internet facing java (apache?) applications that use a vulnerable log4j library and\or ...
1 vote
2 answers
171 views

An application started by the root user has root privileges?

I'm starting node.js on my server. I have to start the node.js HTTP server as root, because it will listen on the port 80. Once i start the node.js on port 80, if a person is able to execute some code ...
  • 111
0 votes
0 answers
236 views

Facebook app permissions

According to an answer to this question : Bypass app permissions, I changed by curiosity the application permission of Facebook and Messenger for the camera to always ask. I'm using CyanogenMod 12.0. ...
  • 782
-7 votes
2 answers
1k views

PHP injection on 777 file [closed]

Some one has modified a PHP file, which had permissions set to 777, on my VPS server. How can someone do that without administrative access to the server? What information I can give you? I know ...