1

Does a normal* user have permissions to write anywhere else than his own home dir? (no sudo and those privilege escalation tools)

I say normal because I do not know more categories than root and normal. Let say the involved user installed the system and do the administrative things with sudo <command>.

I use Ubuntu, by the way.

Thanks.

  • /usr/local in Debian is owned by the staff group. Being a member of staff is perhaps not entirely normal, but it isn't anything like being a superuser either. – Faheem Mitha Feb 11 '16 at 17:15
  • Thanks, that is interesting, I added the detail in the question explaining that I use Ubuntu – onlycparra Feb 11 '16 at 17:24
  • 1
    ubuntu is debian based Linux distribution, but as I tried to explain in my comment below, by default, a newly created user doesn't get membership to staff group. It is something the sysadmin should deliberately grant to the user. – MelBurslan Feb 11 '16 at 17:38
  • Yes, of course a newly created user does not get membership to the staff group. I never suggested that was the case. However, membership in staff is a relatively minor privilege, as far as I can tell. I do not have documentation confirming this, but as far as I know, the only thing membership in staff gets you is the ability to write to /usr/src. – Faheem Mitha Feb 11 '16 at 18:16
  • Is there some reason that simply browsing around and checking the permissions wasn't an option for you? – underscore_d Feb 11 '16 at 21:49
7

Yes. The normal/unprivileged user can write to /tmp and /var/tmp, for legitimate reasons. Also, if the user or group permissions of a given file/directory includes those of the user, he or she can write to those files or directories as well.

Having said that, providing write capability to operating system files and directories to a normal user, is shooting one's self at the foot, as best as an analogy goes. There is a lot to say about this but this is not the place. If you are curious about why ? I suggest searching for and reading articles about "UNIX/Linux system administration best practices".

  • Thanks, I see, but "by default" is the normal user in some of those groups able to write outside the home? – onlycparra Feb 11 '16 at 17:16
  • 1
    On linux, when you create a normal user, it gets created with a new group, which is equal to user's name. Say, for me, it would be mel:mel. Unless root makes an explicit ownership or permission change on any directory, this user is not able to write to any other place than his/her home directory and /tmp and /var/tmp – MelBurslan Feb 11 '16 at 17:19
  • That's perfectly clear, so, that is the behavior for pure Linux. Do you know if Ubuntu does some other change? – onlycparra Feb 11 '16 at 17:23
  • not that I know of. – MelBurslan Feb 11 '16 at 17:23
  • @Faheem has commented in the question something about that in Debian. – onlycparra Feb 11 '16 at 17:26
5

/tmp and possibly /var/tmp are writtable to any users.

  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. - From Review – PersianGulf Feb 11 '16 at 17:44
  • Also /run/shm for example – JorgeeFG Feb 11 '16 at 18:48
  • @PersianGulf: This is actually the minimal answer to the literal question. It doesn't expand on any of the issues about why this is good or bad. It could be a comment, but it's actually valid as an answer. – Peter Cordes Feb 11 '16 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.