network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 4 months |
| seen | May 16 at 12:17 | |
| stats | profile views | 1 |
|
Jan 27 |
awarded | Scholar |
|
Jan 27 |
accepted | The relationship between execute permission on a directory and its inode structure |
|
Jan 24 |
comment |
Can a user brute-force a directory listing without having read permission on the directory? Tripleee, yes, nesting restricted directories does increase obscurity, not security, but a user trying by brute force to find out which subdirectories he has permissions to access is a different situation than a user being able to obtain a list of existing subdirectories, irrespective of their permissions. |
|
Jan 24 |
comment |
Can a user brute-force a directory listing without having read permission on the directory? It matters for protection: If a user wants to share a folder with another user, why should the other user know anything about other folders in the parent directory? The principle of least privilege applies here. And permission to access it (execute bit) does not imply permission to read all of the other contents of the folder (or so I thought until I asked this question). There is a reason the two permission bits are distinct. |
|
Jan 24 |
awarded | Supporter |
|
Jan 24 |
comment |
Can a user brute-force a directory listing without having read permission on the directory? Schaiba, just to elaborate: If a user can generate a list of file names (this is the brute-force part) and test each one, the error message could be used to filter the list so it only contains existing subdirectories. |
|
Jan 24 |
revised |
Can a user brute-force a directory listing without having read permission on the directory? deleted 3 characters in body |
|
Jan 24 |
awarded | Student |
|
Jan 24 |
comment |
Can a user brute-force a directory listing without having read permission on the directory? Schaiba, those are two different kinds of information: In neither case can the user access the subdirectory, but he can tell whether or not the subdirectory exists at all by the error message, which, if it's true, completely bypasses the read permission bit on the parent directory. |
|
Jan 24 |
asked | Can a user brute-force a directory listing without having read permission on the directory? |
|
Jan 22 |
awarded | Editor |
|
Jan 22 |
revised |
The relationship between execute permission on a directory and its inode structure Clarified point 5, which was an invalid assumption as originally worded. |
|
Jan 17 |
answered | Why are .so files executable? |
|
Jan 17 |
answered | The relationship between execute permission on a directory and its inode structure |
|
Jan 17 |
comment |
The relationship between execute permission on a directory and its inode structure bahamat, thank you for your reply. I know that execute on a directory allows you to set the current working directory there (I acknowledged that in my question), but I'm talking about the underlying data structures. Essentially, I'm asking, why can you obtain a listing without the ability to look up the directory's inode number? |
|
Jan 17 |
comment |
The relationship between execute permission on a directory and its inode structure jordanm, thank you for your reply. System calls may take path names, but whether or not the call is permitted depends on the permissions of the inodes. Regarding your example, can you be more specific? Are you talking about hard links, symlinks, or something else? Also, it seems that what you claim means this (read.cs.ucla.edu/111/_media/notes/inode.jpg) is wrong, correct? |
|
Jan 17 |
awarded | Teacher |
|
Jan 17 |
answered | How to solve the issue that a Terminal screen is messed up? (usually after a resizing) |
|
Jan 17 |
asked | The relationship between execute permission on a directory and its inode structure |
