Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have abused sudo.

I have created a really really short life temporary directory that I wanted to share between some users for a few hours... and I named this directory /some/path/tmp

Unfortunately I have launched sudo chown 777 -R /tmp instead of sudo chown 777 -R tmp

so my /tmp file is now completely public...

I use the common /tmp pretty often (every day, almost every hour) personally for short life files, scripts, lots of scripts.

Is it a security breach now that it is completely set to public? Should I change it back to more secure settings, or like common default settings for a Debian / Ubuntu distro - (I don't know which they were)? What are the common right settings for /tmp?

share|improve this question
    
Beware that I forgot something important in my initial answer: the X11 socket needs to be publicly accessible, otherwise you won't be able to start new GUI applications. I've updated my answer. –  Gilles Apr 8 '13 at 9:36

3 Answers 3

up vote 28 down vote accepted

The normal settings for /tmp are 1777, which ls shows as drwxrwxrwt. That is: wide open, except that only the owner of a file can remove it (that's what this extra t bit means for a directory).

The problem with a /tmp with mode 777 is that another user could remove a file that you've created and substitute the content of their choice.

If your /tmp is a tmpfs filesystem, a reboot will restore everything. Otherwise, run chmod 1777 /tmp.

Additionally, a lot of files in /tmp need to be private. However, at least one directory critically needs to be world-readable. The following command should mostly set things right:

chmod -R go-rwx /tmp/* /tmp/.[!.]*
chmod 777 /tmp/.X11-unix /tmp/.X11-unix/*
chmod 1777 /tmp

I.e. make all files and directories private (remove all permissions for group and other), but make the X11 socket accessible to all. Access control on these sockets is enforced by the server, not by the file permissions. There may be other sockets that need to be publicly available. Run find /tmp -type s -user 0 to discover root-owned sockets which you may need to make world-accessible. There may be sockets owned by other system users as well (e.g. to communicate with a system bus); explore with find /tmp -type s ! -user $UID (where $UID is your user ID).

share|improve this answer
1  
could you explain the second chmod more? –  Bartlomiej Lewandowski Apr 8 '13 at 8:38
    
@BartlomiejLewandowski go-rwx: no permissions for group and others. This sets the permissions to rwx------ (except that files that were created since the chmod may end up with fewer permissions, e.g. rw-------). In other words, the files will be accessible only by their owner. /tmp/.[!.]* is to include dot files, which commonly exist in /tmp. –  Gilles Apr 8 '13 at 9:28
    
@BartlomiejLewandowski: chmod -go-rwx : set "rwx" rights to Owner and Group. r=read, w=write, x=execute(for file) or enter/traverse(for directory). 777 = rwxrwxrwx (the right part can be seen as : "set 'r' set 'w' set 'x', set 'r' set 'w' set 'x', set 'r' set 'w' set 'x'" , which in binary is represented as "111111111" (1 to set, 0 to unset) . And "111111111" in binary is represented in octal as "777" (octal = groups of 3 bits, each group having value 0 to 7). if "rwxr-xr--" it would be "111101100" which in octal is "754" –  Olivier Dulac Apr 8 '13 at 11:12
    
The +t is referred to as the sticky bit. That's what keep anyone other than the owner from being able to remove files, even though the permissions are 777 otherwise. The sticky bit was originally to get the kernel to leave commonly programs in memory when they exited so they wouldn't have to be fetched from disk when next run. We're talking PDP11 days.... –  kurtm Oct 8 '13 at 21:51

/tmp and /var/tmp should have read, write and execute rights for all; but you'd usually would also add the sticky-bit (o+t), to prevent users from removing files/directories belonging to other users. So chmod a=rwx,o+t /tmp should work.

As for changing permissions recursively... As long as the owner/group remains as it is for the files and directories, it shouldn't be that much of a problem. But you could perhaps change the permission of everything under /tmp (not /tmp itself) to ensure users' privacy, by removing the rx rights of others and perhaps the group.

Find is a good way of doing this. As root, do:

cd /tmp
find . -type f -exec chmod u=rw,go= {} \;   # (or u=rw,g=r,o= {})
find . -type d -exec chmod u=rwx,go= {} \;  # (or u=rwx,g=rx,o= {})
share|improve this answer
    
On a typical desktop system, you'd better make /tmp/.X11-unix/* world-readable as well, or you won't be able to start X applications any more. –  Gilles Apr 8 '13 at 22:51
[root@Niflheim tmp]# ls -alF .
total 1632
drwxrwxrwt 15 root root    4096 Apr  7 04:24 ./
drwxr-xr-x 28 root root    4096 Apr  2 21:02 ../
[root@Niflheim tmp]# stat -c '%A %a %n' .
drwxrwxrwt 1777 .

From a CentOS 5.9 machine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.