Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

On shared unix hosting, if I have a file sensitive-data.txt and I issue:

chmod 600 sensitive-data.txt

Can root user still read my file? Specifically I'm wondering if it's safe to store my password in mercurial hgrc file.

UPDATE

Decided to use the mecurial keyring extension as it was super easy to setup:

pip install mercurial_keyring

and then add to hgrc:

[extensions]
mercurial_keyring =

However I'm still interested in the answer to this question.

share|improve this question

6 Answers 6

up vote 36 down vote accepted

Yes, root can:

$ echo Hello you\! > file
$ chmod 600 file
$ ls -l file
-rw------- 1 terdon terdon 11 Feb 27 02:14 file
$ sudo -i
# cat file
Hello you!

In any case, even if root couldn't read your files as root, they can always log in as you without a password:

$ whoami
terdon
$ sudo -i
[sudo] password for terdon: 
# whoami 
root
# su - terdon
$ whoami
terdon

So, root can change to any other username using su (or sudo -iu username) and will then be able to do anything at all as though they were you.

share|improve this answer
2  
+1 but why is root a "he"? –  Joseph R. Feb 27 at 1:28
29  
@JosephR. Because it's a privileged account. ... :D ... ... I'll show myself out. –  Sammitch Feb 27 at 1:51
2  
@JamesRyan Wikipedia begs to differ. –  Joseph R. Feb 28 at 11:47
1  
@Sammitch: Totally unrelated question, but do you blush when women enter the room or talk to you, like all of us nerds do? –  phresnel Feb 28 at 13:27
1  
@JamesRyan first of all, they is not "less grammatically correct" (what does that mean anyway? Something is either grammatical or it isn't). In fact, they has been used as a gender-neutral singular pronoun for centuries‌​, from Shakespeare to Twain. Second, while he can and indeed is often used as a gender neutral pronoun (as I used it here) there is a movement away from that. Third, comments are not suited for such discussions, bring it to English Language & Usage if you like. –  terdon Feb 28 at 14:31

Always assume that root (and any other user/process with CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH) can do everything unless an LSM (SELinux, AppArmor or similar) prevents him from doing that.

That means also that you should assume that all your keystrokes can be read. Passwords aren't really safe. If you want a serious level of security then you must use a system which is completely controlled by you (and not even used by anyone else).

share|improve this answer
    
This is actually my problem with capabilities as they're currently implemented. Since they don't specify targets, you need to have type enforcement that supersedes capabilities (like SELinux) just to keep that from happening. Giving one user CAP_DAC_OVERRIDE gives them in one foul swoop all the privilege they need to override any other security mechanism on the system. CAP_DAC_OVERRIDE is basically CAP_DO_WHATEVER_YOU_WANT. –  Bratchley Mar 14 at 20:13

In traditional Unix, root is all-powerful. In particular, root can read any file, and even snoop at what your programs are doing internally. If the data is really sensitive, keep only encrypted copies around (consider e.g. GNU Privacy guard for this, but read its documentation carefully before), and never decrypt it on a machine not under your complete control.

(Paranoia is wonderful, there never is enough of it ;-)

Seriously, think carefully about the costs the leakage of the data could cause, and thus how much you will be prepared to pay for security. Perfect security is impossible, to get a bit more security the cost starts to increase rapidly. But take care not to fall into the trap of an expensive measure which really doesn't increase security...

share|improve this answer

Yes root have all the privileges to do anything

Here you can see I have created a Directory name test and touched a file lonston.txt and listed the files

root@system99:/tmp# mkdir test && touch lonston.txt && ls -l
total 4
-rw-r--r-- 1 root root    0 Feb 27 16:35 lonston.txt
drwxr-xr-x 2 root root 4096 Feb 27 16:35 test

Then i have changed the permission of file and Directory to null permission using 000 and listed to see the permission

root@system99:/tmp# chmod 000 lonston.txt && chmod 000 test && ls -l
total 4
---------- 1 root root    0 Feb 27 16:35 lonston.txt
d--------- 2 root root 4096 Feb 27 16:35 test

Then even i can Write to the file and the read the file using cat

root@system99:/tmp# echo "Yes root have all Privileges than other user's, let we see the permission of user's too" > lonston.txt 

root@system99:/tmp# cat lonston.txt 
Yes root have all Privilages than other user's, let we see the permission of user's too

Even i can get into the directory which has d--------- (null) 000 permission, even root have no read or Write Permission.

root@system99:/tmp# cd test/
root@system99:/tmp/test# pwd
/tmp/test

Even i can Create the files and folder's after the change of permission from any were

root@system99:/tmp/test# touch /tmp/test/lonston/testdir/babin.txt

root@system99:/tmp/test# ls -l /tmp/test/lonston/testdir/
total 0
-rw-r--r-- 1 root root 0 Feb 27 16:39 babin.txt

Now here we can see Permission with 400

root@system99:/tmp/test# chmod 400 babin.txt

List to see the file permission

root@system99:/tmp/test# ls -l
total 8
-r-------- 1 root root   34 Feb 27 16:42 babin.txt
drwxr-xr-x 3 root root 4096 Feb 27 16:38 lonston

Using vim im i have added 1 line to the file babin.txt

root@system99:/tmp/test# vim babin.txt

But while in vim mode it will notice us W10: Warning: Changing a readonly file But it still Writeable

Now we can cat the file for output

root@system99:/tmp/test# cat babin.txt 
hi this is the write persmission 
this is added while the file have 400 permission

Then i have logout from root user to normal user and listed the file having null permisson what in root too

root@system99:/tmp# exit
exit

Navigate to /tmp Directory

sysadmin@system99:~$ cd /tmp/
sysadmin@system99:/tmp$ ls -l
total 8
---------- 1 root root   88 Feb 27 16:36 lonston.txt
d--------- 2 root root 4096 Feb 27 16:35 test

But while reading the file from normal user we can't

sysadmin@system99:/tmp$ cat lonston.txt 
cat: lonston.txt: Permission denied

sysadmin@system99:/tmp$ cd test/
cat: test/: Permission denied

That's it, Hope you got the power of root User

If you in Normal User, if you need to root privilege we need to use sudo, it will ask sudo password

example :

sysadmin@system99:/tmp$ sudo cat lonston.txt 
[sudo] password for sysadmin: 
Yes root have all Privilages than other user's, let we see the permission of user's too

Sudo user have collabration with root user's Group so what sudo have the root privilege.

To know more about sudo

# man sudoers

Here we can see they have defined as the normal user can have Sudo rights Only fewer lines i have mentioned here.

sysadmin@system99:/tmp$ sudo cat /etc/sudoers

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Totally we can read or edit or Delete the files even root Doesn't have the read permission.

share|improve this answer
1  
Why does this answer has so few upvotes? It covers almost all cases that can occur with examples. –  Foo Bar May 31 at 13:50

It should also be assumed that anyone who might have an opportunity to be in the same room as the hardware can read or write anything they want. If they are very patient, they can eventually understand encrypted data. They do not need side-channel methods if they can replace the encryption software.

share|improve this answer
    
Nice point, thank you! –  user2422869 Sep 3 at 7:38

Yes, the root can read protected file even when the owner cannot (while the owner obviously can remove protection and then read the content):

echo "123" > abc.txt
chmod 000 abc.txt
cat abc.txt

cat: abc.txt: Permission denied

su
cat abc.txt

123

However under normal setup, the root cannot access protected files on the remote filesystems like NFS ("root squash").

share|improve this answer
    
+1 for mentioning NFS root squash. However, as long as root can su to the user owning the NFS-mounted directory, root squash still doesn't protect. –  Jenny D Apr 3 at 14:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.