Tag Info

Hot answers tagged

17

You can use the Linux dynamic linker/loader directly to run ELF executables for which you have read, but not execute rights: $ /lib/ld-linux.so.* /home/user1/binary_program When an ELF executable is executed ordinarily, the dynamic linker which is stored in the .interp section of the program code is used. Reasons for invoking the dynamic linker directly ...


15

Since you have read permission: $ cp ~/binary_program my_binary $ chmod +x my_binary $ ./my_binary Of course this will not auto-magically grant you escalated privileges. You would still be executing that binary as a regular user.


13

Just use the -w flag of the test utillity: [ -w /path/to/file ] && echo "writeable" || echo "write permission denied" Note that if you're going to write to the file later, it's still possible that you won't be able to write to it. The file may have moved, the permissions may have changed, etc. It can also happen that -w detects write permissions ...


10

The major difference between sudo and su is the mechanism used to authenticate. With su the user must know the root password (which should be a closely guarded secret), while with sudo the user uses his/her own password. In order to stop all users causing mayhem, the priviliges discharged by the sudo command can, fortunately, be configured using the ...


9

I know dd is supposed to be a power user tool but still, it doesn't make sense to me that you can basically screw your whole computer by hitting the wrong key. Consider the kinds of power tools used in civil construction and what you can screw up by doing one little thing wrong. Could those things be made more preventable? Probably, but the counter ...


8

In Linux/Unix the user with user id 0 is such a super administrator. The user is usually called "root", but the magic is really behind the id and not the name. That user is especially not bound to local file access permissions and can read and write any file. That user also has the ability to change to any other user without needing a password.


6

There are two commands related to root privileges, SUDO and SU. With SUDO, you don't become another user (including root). SUDO has a pre-defined list of approved commands that it executes on your behalf (this addresses what I asked in the comment about how you give selected users selective privileges). Since you are not becoming root or another user, you ...


5

Actually apt-get --reinstall install package should work, with files at least: ➜ ~ ls -l /usr/share/lintian/checks/version-substvars.desc -rw-r--r-- 1 root root 2441 Jun 22 14:19 /usr/share/lintian/checks/version-substvars.desc ➜ ~ sudo chmod +x /usr/share/lintian/checks/version-substvars.desc ➜ ~ ls -l ...


5

You are able to write to the file because you are the root user. Consider the following: > cat file.txt > ls -al file.txt -r-------- 1 sdanna staff 0 Sep 21 20:43 file.txt > ./a.out Segmentation fault: 11 > sudo ./a.out > cat file.txt Test string Here ./a.out is your presented program. As you can see, when I run the command as a ...


5

Yes, to do so, you would want to set the sticky bit for that directory. excerpt Another important enhancement involves the use of the sticky bit on directories. A directory with the sticky bit set means that only the file owner and the superuser may remove files from that directory. Other users are denied the right to remove files regardless of ...


5

It's reasonable to ask why the dd command doesn't first check whether its target contains a mounted filesystem, and then prompt for confirmation or require a special flag. One simple answer is that it would break any scripts that expect to be able to use dd in this way, and that aren't designed to handle interactive input. For instance, it can be reasonable ...


4

After looking at this answer to a related question, I think I understand. A directory is a list of files, and "executing" that directory means following the links in the directory list to the files themselves. Thus, since I don't have execute permissions on x, I can't resolve the path x/y to the actual file y in the command mv x/y x/w. (In order to get the ...


4

It sounds like opatch is a script. That is, it is a text file that starts with #! and lists its interpreter (maybe /bin/sh). Only compiled binaries (directly executable code) can be executed without read permission. For all scripts, no matter the interpreter (sh, python, etc...), the interpreter needs to be able to open the file, which mandates read ...


3

Put a* and d* under quotes, so that shell would not expand them,and also add -name keyword. If you only want to search for files and not also directories for example then add -type f. find . -name 'a*' -type f -exec chmod o+r {} \; find . -name '*d' -type f -exec chmod o+x {} \; If you want to change only in current directory and not subdirectories, add ...


3

You can use wildcard characters, also called globs or filename patterns. The character * stands for any character sequence, so * matches all files in the current directory. (Exception: files whose name begins with ., called dot files, are not matched.) Thus: chmod g=rw * If you want to affect files in subdirectories as well, including the directories ...


2

You can use namei -m /path/to/really/long/directory/with/file/in which will output all of the permissions in the path in a vertical list. or namei -l /path/to/really/long/directory/with/file/in to list all owners and the permissions


2

A green background means that the directory has write permission for others, not that it is traversible. Remove these privileges instead: chmod o-rw *


2

When you add keys to an authorized_keys file you have several options to restrict what that key can do. In this situation, you can disallow running any commands. Simply prefix it with command="". For example: command="" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDc7nKsHpuC6W/U131p0yDh455sLE9pWmFxdK... When the user wants to connect, they have to pass -N to ...


2

Yes each applications typically has it's own permissions set via "permission bits" on the actual application. You can see these if you use the command ls -l on the various executables that you're trying to run. $ ls -l /sbin/ | grep autrace -rwxr-x---. 1 root root 15792 Aug 24 14:40 autrace 03:03:22-slm~ $ autrace bash: /usr/sbin/autrace: Permission ...


2

Using GNU find, you can search for all directories and files that belong to groupX: find / -group groupX From man find: -group gname File belongs to group gname (numeric group ID allowed).


2

You can try the -w switch of the test utillity: [ -w /path/to/file ] && do_command /path/to/file || sudo do_command /path/to/file Or the long version: if [ -w /path/to/file ]; then do_command /path/to/file else sudo do_command /path/to/file fi From the manpage -w FILE FILE exists and write permission is granted


2

There isn't any native mechanism to easily achieve it. Linux's permission system cannot specify separate permissions for creating files and directories because directories are files in fact. But try such way: Make all archive directories to be owned by a one (or few different) user, created just for this purpose. Lets assume its name archiveuser. Make all ...


2

Another approach: if >> /path/to/file then echo "writeable" else echo "write permission denied" fi This will attempt to open the file for appending, and, if that succeeds, run no command (i.e., run a null command) with output to the file.  Beware that this creates an empty file if it didn't exist. The -w operator of the test command might ...


2

Short answer is you can't. If you allow someone (e.g. simth) in sudoer's group, he can issue a sudo su - then become root, then anoter user (e.g. wesson). This is an alternate way of giving root's password to simth. However he (smith) can change root passwd. Notes also that 1) you must specify in /etc/sudoers a line like %sudo ALL=(ALL:ALL) ALL 2) ...


2

Now, I believe with setuid any user could execute the script. Not quite. To make the script executable by every user, you just need to set a+rx permissions: chmod a+rx script setuid means that the script is always executed with the owner's permissions, that is, if you have the following binary: martin@dogmeat ~ % touch dangerous martin@dogmeat ~ % ...


2

I think you're pointing to this from the man page: When the owner or group of an executable file are changed by an unprivileged user the S_ISUID and S_ISGID mode bits are cleared. So why are they cleared now. You see they are only cleared in case of an executable file. Because when one of the bits (SUID/SGID) is set, the unprivileged user can ...


1

I think you misread man 2 chown: you don't have to clear S_ISUID and S_ISGID, they will automatically be cleared when you use that function as an unprivileged user. If your program is running as root the behaviour (on Linux) depends on the kernel version. If you need the bits set, just reapply them (assuming the account that tries to set them has the ...


1

Your understanding is wrong. root is all-powerful, and becoming other users is a critical part of root's usefulness.


1

All permission bits can be set or cleared independently. Some combinations are very common, others serve no practical purpose. ls uses a capital letter S to mean “s without x” to highlight that this is an odd, possibly erroneous setting. If a file is not executable by anyone, its setuid and setgid bits are not relevant. Keep in mind that even if the file's ...


1

There are several things to prevent users to execute commands: File permissions You can check them with ls -l <file>, in the form of something like "rwxr-xrw-", which defines the owner, group and other users' permissions to that file, being read, write and execution. Access Control List If the mounted device has acl enabled you can get its ...



Only top voted, non community-wiki answers of a minimum length are eligible