Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Let's say that permissions for user and group are set up correctly on a directory. Would a 0 permission for other on that directory provide effective access control for the directory's files and subdirectories? Are there gotchas to consider?

When you create files that are rw to other people (like with Unix Domain Sockets) people think of it as a security issue, since there's a race condition that a malicious user can exploit before proper permissions are applied to a file. That's why I'm looking for an "atomic" way of doing basic permissioning.

share|improve this question
add comment

2 Answers 2

The 3 bits for "other" permissions will deny all access if they are 000 (in binary) or 0 (in octal, the base entered numerically in chmod) or --- as viewed in ls -l. Note that "all access" is relevant to the file. The file's existence can still be seen if access to the directory the file is in is allowed. You can do chmod o-rwx filename to take away permissions for others, while not changing the permission for group members and owner.

To make permissions be set atomically, this can be done at the programming level when doing programs with system call bindings. Otherwise set the umask for the shell process with the shell's umask command, which is inherited by processes the shell starts. The bits of umask which are on will cause the corresponding bits in created files to be made 0. This is the atomic way you are looking for that leaves no window of exploit opportunity. A umask of 022 would normally give files a permission of 644 (rw-r--r--), and directories a permission of 755 (rwxr-xr-x). A umask of 027 would give permissions of 640 (rw-r-----) and 750 (rwxr-x---).

share|improve this answer
    
Thanks for describing umask. However, in the first paragraph you're talking about file permissions while I am concerned whith the effect of a parent directory permission. –  m33lky Dec 22 '11 at 18:38
add comment

To access a file you need access to the directories above it. Disabling access to the directory as you noted will secure the file. If a user has access to the directory, they can see files even if they can't access the contents of the file.

The access bit:

  • x allows contents of the the directory to be accessed;
  • r allows contents of the directory to be listed; and
  • w allows contents of the directory to be changed.

It is possible to link the same file in several directories on the same disk. You need to ensure all directories are protected.

Clearing the access for others still allows access for the user and members of the directories group.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.