2

In unix, I know that you have to be a member of a group to change the group owner of a file to that group even if you own it, but can someone please tell me why. I don't understand why you shouldn't be able to change which group has special access privileges of your file if that group isn't one your a member of.

1

Because if you are able to change ownership of a file to a different group with malicious intent, or even accidentally, you might inflict some hurt on others that you have no real relation to. But if you are member of a group, it means you have some skin in the game. And whatever hurts this group, might eventually hurt you. It is the same principle , why only root can change the ownership of files from one user to another. It is a security measure.

| improve this answer | |
  • 1
    What sort of harm can you do to a group by allowing them access to a file? You can always allow world access so presumably that would cause the same harm, whatever that may be. – psusi Mar 23 '16 at 23:03
  • 1
    @psusi consider a group executable file that underhandedly changes the group ownership or other permissions of a file this user was not able to access before, in such a way trhat this person now is able to snoop. I can think of a file listing salaries of executives only accessible by finance, being opened to be read by the whole world. At the least it is an attack vector and should be dealt with and OS deals with it this way. – MelBurslan Mar 23 '16 at 23:11
  • 1
    A more direct example of the harm you could inflict is, if the system uses disc quotas, then the group might have some extra quota for files belonging to the group. If you could place files in that group you could exhaust their quota. – Henrik supports the community Mar 23 '16 at 23:37
  • 1
    Ahh, now that is a good reason. Giving permission is something you can do anyway via world, but quota charges are a gift that the recipient might not want. Add that to your answer and I'll switch my vote. – psusi Mar 24 '16 at 21:56
1

@Melburslan is correct in his explanation, but also left out one key factor. Quotas. If you were able to change the group membership to something you didn't own... you could effectively bypass possible quota limits. Additionally, this prevents security exploits with "setgid" bits. i.e. If you set the "setgid" bit on a file then change the group to something with administrative privileges that you are not a member of... you can start processes that you would not normally have permissions for.

| improve this answer | |
  • 1
    suid/setgid are automatically cleared when you chown a file. – psusi Mar 24 '16 at 21:58
  • 1
    @psusi that hasn't always been true... and as a paranoid-security geek, I wouldn't want to solely rely on that being 100% true. Still quota concerns still apply. – TheCompWiz Mar 25 '16 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy