Can someone change content of a file with permission 777 on a server?

Question

If in my server I have a file(for example a php file) with permission 777, can someone edit or delete it without having an account on the server?

Answer 1

There are a couple ways I can think of that someone would be able to modify the file.

First, if they have physical access to the server, they can get the disk, mount it, and do anything they want to it.

Second, they can exploit some other accounnt on the server to do what they want - if that account has permissions to see that file (and 777 will give it if there are no ACLs or other security measures in place), then that person can modify the file. If it is a PHP file, the user that your web server runs as probably has permission to view the file, so if that is compromised, your file is exposed.

Answer 2

You can only modify a file if you can somehow write to the specific file. If you don't export the filesystem to a remote system there is no direct possibility to modify the file even with such relaxed permissions.

This doesn't mean you should use such relaxed permissions as the situation changes if you offer some kind of service on your machine, like webserver, ftp server etc. There is a possibility that some applications you are offering have some security problems like for example a website you are hosting on this server. This would allow someone without an account on your server to modify the file through the specific service, e.g. the change would occur as of the user the service is running, e.g. www-data

Answer 3

To be able to edit that file, a process needs to have execution permission to all parent directories leading up to the file.

To be able to delete that file, a process needs to have execution permission to all parent directories leading up to the file, and write permission to the directory in which the file resides.

As per doing anything "without having an account on the server"... All processes must run with an effective user id, so without a user id no process can be running, so the answer is no.