[techtalk] partitioning security (was lilo)

Julie jockgrrl at austin.rr.com
Thu Jul 26 09:36:40 EST 2001


Almut Behrens wrote:
> 
> On Wed, Jul 25, 2001 at 11:21:48PM -0500, Julie wrote:
> >
> > So if you have "/tmp/foo" and it's a symbolic link to "/root/private"
> > and /root has permissions 0700, you can only perform the operations
> > on "/tmp/foo" that you could perform if you replaced that name with
> > "/root/private".  If "/tmp/foo" is a hard link, the permissions on
> > "private" determine what rights you have.  So if "private" has
> > permissions 0666 you can write to the file if it is a hard link,
> > but not if it is a soft link (and you aren't root ...).
> 
> sorry for being picky, but I don't think that the latter statement
> about the hardlink is technically correct.

Nope, absolutely and positively very technically correct.

In the case of a symbolic link, access is controlled by the
directory look-up permissions of all intervening directories
on the way to the pointed to object, then on the actual modes
of the object itself.

So for "/root/private" where "/root" has mode 0700, only the
directory owner (and root -- who are presumably the same person
in this example ...) have permission to search files in lower
level directories.  The 0666 permissions on "private" in that
directory grant read and write permission to any user who can
perform a directory lookup on that file.  Which, when the name
is located in /root is ... root.

The same applies to hard links, except it isn't the "pointed
to" object, it is the object itself.

So for "/tmp/private", where "/tmp/private" is a hard link to
"/root/private" in the above example, "/tmp" is a world
accessible directory, so the bad guy has directory lookup
permission to resolve the name "/tmp/private".  The 0666
permissions on "private" then grant read-write access
to the user.

Thanks for demonstrating the confusion that exists over file
permissions, symlinks, and such.
-- 
Julianne Frances Haugh             Life is either a daring adventure
jockgrrl at austin.rr.com                 or nothing at all.
					    -- Helen Keller




More information about the Techtalk mailing list