What is so special about Linux permission 004?

Question

I was reading Practical Unix and Internet Security, when I came across the following lines which I couldn't comprehend.

If you are using the wu archive server, you can configure it in such a way that uploaded files are uploaded in mode 004, so they cannot be downloaded by another client. This provides better protection than simply making the directory unreadable, as it prevents people from uploading files and then telling their friends the exact filename to download.

A permission of 004 corresponds to -------r--. Can't a file be downloaded if it has read access? Also why is it considered better than simply making the directory non-readable? What does this imply?

Note: This is with regard to unauthorised users leaving illegal and copyrighted material on servers using anonymous FTP. The above solution was suggested to prevent this along with a script which deletes the directory contents after a period of time.

Answer 1

The permissions 004 (------r--) means that the file can only be read by processes that are not running as the same user or as the same group as the FTP server. This is rather unusual: usually the user has more rights than the group, and the group has more rights than others. Normally the user can change the permissions, so it's pointless to give more restrictive permissions to the user. It makes sense here because the FTP server (presumably) doesn't have a command to change permissions, so the files will retain their permissions until something else changes them.

Since the user that the FTP server is running as can't read the files, people won't be able to download the file. That makes it impossible to use the FTP server to share file.

Presumably some process running as a different user and group reads the file at some point, verifies that it complies to some policy, copies the data if it does, and deletes the uploaded file.

It would have made more sense to me to give the file permissions 040 (readable by the group only) and have the consumer process run as the same group as the FTP server, but a different user.

Answer 2

The octal permissions mask of 004 corresponds to a symbolic permissions mask of u=,g=,o=r which means that the (u)ser who owns the file cannot read it or write to it or execute it, and neither can other users in the same (g)roup as the user who owns the file. Only (o)ther users who are neither the owner, nor in the same group as the owner, are able to read the file.

Answer 3

Yes, but the file is owned by the user. So the client itself has the 0 permission (user) on the file and cannot read it.

You can test this yourself:

echo TEST > myTestFile;
chmod 004 myTestFile;
cat myTestFile;
chmod 700 myTestFile;
cat myTestFile;

The third step will raise an error.

Answer 4

It seems more likely that it means that any permissions are masked by 004, that is, other users cannot read the file. This would serve to protect the file from other users on the system (to some degree).