Hot answers tagged

7

Yes. The normal/unprivileged user can write to /tmp and /var/tmp, for legitimate reasons. Also, if the user or group permissions of a given file/directory includes those of the user, he or she can write to those files or directories as well. Having said that, providing write capability to operating system files and directories to a normal user, is shooting ...


6

-w- can be useful for fifos or files that can only be opened in append mode (chattr +a on Linux). prw--w--w- me me /var/run/sendstufftome Would allow others to send data, which a dedicated process running as me (but noone else) would read. It's also common for tty devices: $ ls -l "$TTY" crw--w---- 1 stephane tty 136, 25 Jan 18 14:06 /dev/pts/25 $ mesg ...


5

/tmp and possibly /var/tmp are writtable to any users.


3

That would be 476. A good way to remember is that read has the value of 4, write has the value of 2, and execute has the value of 1. Also, the first number is dedicated to owner, the second number to group, and the third one to other. owner group other Read 4 4 4 Write 2 2 2 Execute 1 1 1 You add the numbers together, ...


2

To create the hard-link alice will need write+execute permissions on target-dir on all cases. The permissions needed on target.txt will vary: If fs.protected_hardlinks = 1 then alice needs either ownership of target.txt or at least read+write permissions on it. If fs.protected_hardlinks = 0 then any set of permissions will do; Even 000 is okay. This ...


2

Being unable to change permissions as root on a built-in application or system file on OS X is indicative of System Integrity Protection, a new security feature added in 10.11, which restricts the root account and limits the actions that the root user can perform on protected parts of OS X. Protected parts include /System and pre-installed ...


2

1) u can use the Network-manager or wicd but not the 2 at same time apt-get remove wicd 2)find the network device lspci -nn | grep -i network 3)verify the kernel module lspci -k | grep -i network -A 2 the ouput is somthing like 02:00.0 Network controller: Broadcom Corporation BCM4313 802.11b/g/n Wireless LAN Controller (rev 01) Subsystem: ...


2

It would generally avoid all the sudo and deliberately inhibiting yourself access to your files - it will likely cause you problems and possibly be so annoying you will just override your own protection mechanisms anyway. I would instead use trash-cli which behaves like a desktop type trashcan where you can recover your file later if you make a mistake. ...


2

Why not something like the following? user="foo" group="bar" perm=741 for dir in $(cat dirname.txt); do mkdir ${dir} chown ${user}:${group} ${dir} chmod -R ${perm} ${dir} done I find it best to utilize variables to make future changes easier. Iterating the directory list instead of a one liner is easier to maintain as well


2

You should use the find command. To get all files and directories with rwxrwx--- in the branch of current directory use: find . -perm 770 If you only need to check for files: find . -perm 770 -type f If you only need to check the immediate subdirectories: find . -perm 770 -depth 2


2

It is much more difficult to prevent some particular access than to by default block all access and add specific exceptions for each kind of access. There is even a catchy term for this principle. Therefore, ensure that the commands that can be run via sudo are explicitly specified so that the user can never become root using it. After this has been done you ...


2

Your user does not have the permission to write in the directory you are trying to copy the file. Use root account or try with sudo -u "user" cp file path.


1

It is normally impossible to cause files in a directory to be owned by a particular user (unless that user was writing the files in the first place). The reason is that (under most Unix variants, including Linux) it's forbidden to give away files. However you can achieve this effect by using a filesystem that presents a different ownership of files. One ...


1

First time sudo is invoked password is prompted for. Then, depending on configuration, if invoked within N minutes (default 5 minutes IIRC), one do not need to enter password again. You could do something like: sudo echo >/dev/null || exit 1 or perhaps something like: sudo -p "Become Super: " printf "" || exit 1 at start of script. If you want to ...


1

On Linux, you can back up and restore ownership and permissions (including access control lists but not SELinux contexts) with the ACL tools. Run getfacl -R >permissions.txt in the toplevel directory on the machine with the correct permissions. Copy over the output file to the target machine and run setfacl --restore=permissions.txt in the toplevel target ...


1

You probably want to use rsync. To get that to work, you need to install it on both machines (if it's not installed already). After that, simply run (as root): rsync -avrHP root@source-host:/path/to/source-directory/ /path/to/destination this assumes that: You run the command on the destination host. If you want to run it on the source host, just remove ...


1

In Unix, to do even the most basic stuff, a user needs access to sundry resources (executables, libraries, configuration files, manual pages, examples, ...). Even what is considered "normal commands" like cp(1), ls(1), are regular programs run by the user, who will need to be able to access them. Users need access to much of the system, that can't be cut off ...


1

The problem is that your script is not set to be executable. chmod u+x /bin/ScriptThatCopiesBackup.sh will make the script runnable by its owner (in this case, root).


1

I don't know anything about BackupNinja but if it (like most backup programs) can write to stdout then you can do something like this: echo foo | su -g users nobody bash -c 'umask 177; cat >/tmp/newfile' ls -l /tmp/newfile -rw------- 1 nobody users 4 4. Feb 09:39 /tmp/newfile


1

Your parsing is one letter wrong. In your parsing of syntax variable, you are getting for the string '--r,--r,--r': u='--r' g=',--' o='r,-' You should change your script to: u=${syntax:0:3} g=${syntax:4:3} o=${syntax:8:3} Also a tip, for debugging shell scripts try adding '-x' in your interpreter line. i.e '#!/bin/bash -x' Would give you a lot ...


1

There are a few errors. First, you’re creating your files with commas between each set of three: touch ./{r,-}{w,-}{x,-},{r,-}{w,-}{x,-},{r,-}{w,-}{x,-} But then you’re removing colons. The colon should be a comma. syntax="${i//:}" This might cause trouble if the script is in the same directory: for i in * Of course if you’re running it as ...


1

If you remove the 'w' bit, you can't accidentally overwrite whatever you removed the 'w' bit from. If that's a directory, that means you can't add or remove files from that directory; if that's a file, that means you can't change the file. Downside of that method, however, is that you lose data (IMO, file permissions are part of your backup data). An ...


1

To give a process elevated permissions (in this case, being able to read the file while regular users can't) is exactly the functionality of SUID/SGID. Do read up on the whole UID/EUID mess, it isn't exactly trivial. You might get away by creating a group for this, make the file owned by that group, writeable only by e.g. root and readable by the group, ...


1

Files in Linux and Windows are handled very differently. Windows does not know the executable bit of Linux file permissions. That information (including the other permissions) are lost when transferring files from Linux to Windows or vice versa. Most probably the scp client at the Windows side sets the permissions of the copied files "the Windows way". That ...


1

Network interfaces usually do not appear in /dev at all. Their configuration is not done with accesses to device files but with accesses to the NETLINK socket. I don't think that you can give access to this socket to an ordinary user. You need a suitable sudo rule (and maybe a wrapper script) so that the user can call ip addr.


1

I believe you need is ssh-keygen, which remembers your "device signature". So even you changed your password, it still works as long as you ssh from the same device. Here is a detailed tutorial how to set it up. Does it need to be run in root privilege? No, you only need root privilege on the host-server when you set it up, in order to edit some file ...


1

It was asked before on ServerFault. Quoting with few modification and notes: Start the process with /usr/sbin/sshd -f ~/.ssh/sshd_config where ~/.ssh/sshd_config is a new file you created. Among other options (such as a different host key, different port, etc) you need to add the line UsePrivilegeSeparation no. This will prevent the sshd process from ...


1

In regards to a file, I can't think of a well-known situation where a user would be permitted to write to a file, but not read it. Also, having the execute bit for a file set without the read bit set is pointless since the shell needs to read it in order to execute it. Now in regards to directories, a possible scenario could be some security through ...


1

In order to provide different rights to multiple groups or users use the following commands (Tested on RHEL 6 & 7): To make new owner of group: setfacl -m g:<group_name>:<rights you want to give eg.rwx> -R <directory_name> To check current acl settings: getfacl <directory_name>



Only top voted, non community-wiki answers of a minimum length are eligible