Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
On shared unix hosting, if I have a file sensitive-data.txt and I issue:
chmod 600 sensitive-data.txt
Can root user still read my file? Specifically I'm wondering if it's safe to store my password in mercurial hgrc file.
UPDATE
Decided to use the mecurial keyring extension as it was super easy to setup:
pip install mercurial_keyring
and then add to hgrc:
[extensions]
mercurial_keyring =
However I'm still interested in the answer to this question.
Yes, root can:
$ echo Hello you\! > file
$ chmod 600 file
$ ls -l file
-rw------- 1 terdon terdon 11 Feb 27 02:14 file
$ sudo -i
# cat file
Hello you!
In any case, even if root couldn't read your files as root, they can always log in as you without a password:
$ whoami
terdon
$ sudo -i
[sudo] password for terdon:
# whoami
root
# su - terdon
$ whoami
terdon
So, root can change to any other username using su (or sudo -iu username) and will then be able to do anything at all as though they were you.
Always assume that root (and any other user/process with CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH) can do everything unless an LSM (SELinux, AppArmor or similar) prevents him from doing that.
That means also that you should assume that all your keystrokes can be read. Passwords aren't really safe. If you want a serious level of security then you must use a system which is completely controlled by you (and not even used by anyone else).
CAP_DAC_OVERRIDE gives them in one foul swoop all the privilege they need to override any other security mechanism on the system. CAP_DAC_OVERRIDE is basically CAP_DO_WHATEVER_YOU_WANT.
Mar 14, 2014 at 20:13
Yes root have all the privileges to do anything
Here you can see I have created a Directory name test and touched a file lonston.txt and listed the files
root@system99:/tmp# mkdir test && touch lonston.txt && ls -l
total 4
-rw-r--r-- 1 root root 0 Feb 27 16:35 lonston.txt
drwxr-xr-x 2 root root 4096 Feb 27 16:35 test
Then i have changed the permission of file and Directory to null permission using 000 and listed to see the permission
root@system99:/tmp# chmod 000 lonston.txt && chmod 000 test && ls -l
total 4
---------- 1 root root 0 Feb 27 16:35 lonston.txt
d--------- 2 root root 4096 Feb 27 16:35 test
Then even i can Write to the file and the read the file using cat
root@system99:/tmp# echo "Yes root have all Privileges than other user's, let we see the permission of user's too" > lonston.txt
root@system99:/tmp# cat lonston.txt
Yes root have all Privilages than other user's, let we see the permission of user's too
Even i can get into the directory which has d--------- (null) 000 permission, even root have no read or Write Permission.
root@system99:/tmp# cd test/
root@system99:/tmp/test# pwd
/tmp/test
Even i can Create the files and folder's after the change of permission from any were
root@system99:/tmp/test# touch /tmp/test/lonston/testdir/babin.txt
root@system99:/tmp/test# ls -l /tmp/test/lonston/testdir/
total 0
-rw-r--r-- 1 root root 0 Feb 27 16:39 babin.txt
Now here we can see Permission with 400
root@system99:/tmp/test# chmod 400 babin.txt
List to see the file permission
root@system99:/tmp/test# ls -l
total 8
-r-------- 1 root root 34 Feb 27 16:42 babin.txt
drwxr-xr-x 3 root root 4096 Feb 27 16:38 lonston
Using vim im i have added 1 line to the file babin.txt
root@system99:/tmp/test# vim babin.txt
But while in vim mode it will notice us W10: Warning: Changing a readonly file But it still Writeable
Now we can cat the file for output
root@system99:/tmp/test# cat babin.txt
hi this is the write persmission
this is added while the file have 400 permission
Then i have logout from root user to normal user and listed the file having null permisson what in root too
root@system99:/tmp# exit
exit
Navigate to /tmp Directory
sysadmin@system99:~$ cd /tmp/
sysadmin@system99:/tmp$ ls -l
total 8
---------- 1 root root 88 Feb 27 16:36 lonston.txt
d--------- 2 root root 4096 Feb 27 16:35 test
But while reading the file from normal user we can't
sysadmin@system99:/tmp$ cat lonston.txt
cat: lonston.txt: Permission denied
sysadmin@system99:/tmp$ cd test/
cat: test/: Permission denied
That's it, Hope you got the power of root User
If you in Normal User, if you need to root privilege we need to use sudo, it will ask sudo password
example :
sysadmin@system99:/tmp$ sudo cat lonston.txt
[sudo] password for sysadmin:
Yes root have all Privilages than other user's, let we see the permission of user's too
Sudo user have collabration with root user's Group so what sudo have the root privilege.
To know more about sudo
# man sudoers
Here we can see they have defined as the normal user can have Sudo rights Only fewer lines i have mentioned here.
sysadmin@system99:/tmp$ sudo cat /etc/sudoers
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
Totally we can read or edit or Delete the files even root Doesn't have the read permission.
In traditional Unix, root is all-powerful. In particular, root can read any file, and even snoop at what your programs are doing internally. If the data is really sensitive, keep only encrypted copies around (consider e.g. GNU Privacy guard for this, but read its documentation carefully before), and never decrypt it on a machine not under your complete control.
(Paranoia is wonderful, there never is enough of it ;-)
Seriously, think carefully about the costs the leakage of the data could cause, and thus how much you will be prepared to pay for security. Perfect security is impossible, to get a bit more security the cost starts to increase rapidly. But take care not to fall into the trap of an expensive measure which really doesn't increase security...
It should also be assumed that anyone who might have an opportunity to be in the same room as the hardware can read or write anything they want. If they are very patient, they can eventually understand encrypted data. They do not need side-channel methods if they can replace the encryption software.
Yes, the root can read protected file even when the owner cannot (while the owner obviously can remove protection and then read the content):
echo "123" > abc.txt
chmod 000 abc.txt
cat abc.txt
cat: abc.txt: Permission denied
su
cat abc.txt
123
However under normal setup, the root cannot access protected files on the remote filesystems like NFS ("root squash").
In order to prevent root or any one from being able to read your files, you need to encrypt them. File Encryption is a very convenient option to look into if you wish to avoid having to deal with complex file system manipulations.
Encryption Options:
If choosing Option 1, here's a way for you encrypt your files:
cat (your-file) | openssl aes-128-cbc -a -salt -k "(specify-a-password)" > (your-file).enc
To decrypt the above file, you run a command like this:
cat (your-file).enc | openssl aes-128-cbc -a -d -salt -k "(specify-the-password)" > (your-file).dec
-- You might want to put the above in a script so it doesn't show up in your history. Or, you can just remove the "-k" parameter, which will prompt openssl to ask you for a password.
If choosing Option 2, simply copy and paste your script to the following site:
http://www.kinglazy.com/shell-script-encryption-kinglazy-shieldx.htm
Upon submission of your script to that site, a zip file will be instantly created for you. Copy the link to the zip file, then go to your UNIX box and perform these steps:
Once you complete the preceding steps, you can then just run your encrypted script from wherever it is you specified to have it installed in step 4....i.e. /home/(your-username)/(your-encrypted-script).sh
