2

Symbolic link not working, using standard UBUNTU 16 LTS... It shows "Permission denied" where I expected to get access, not working even after chown.

Full example:

sudo rm /tmp/file.txt  # if exist, remove

cd ~
sudo chmod 666 data/file.txt
ls -l data/file.txt    # "-rw-rw-rw-" as expected
more data/file.txt     # working fine
sudo ln -sf $PWD/data/file.txt /tmp/file.txt  # fine
ls -l /tmp/file.txt    # "lrwxrwxrwx",  /tmp/file.txt -> /home/thisUser/file.txt
more /tmp/file.txt     # fine

sudo chown -h postgres:postgres /tmp/file.txt

sudo more /tmp/file.txt   #  NOT WORK! but its is sudo! and 666!
  • What does "NOT WORK" mean? – thrig Jan 11 '17 at 16:29
  • I guess what you want is: sudo chown postgres:postgres /tmp/file.txt – NarūnasK Jan 11 '17 at 16:48
8

These actions should result with an error message: Permission denied. The directory, /tmp, has permissions including the sticky bit. The error is a result of the kernel configuration for fs.protected_symlinks.

To show the setting, sysctl fs.protected_symlinks. This equals 1 when set. To disable temporarily, which is not recommended, sysctl -w fs.protected_symlinks=0. To turn off permanently, which is again not recommended, use /etc/sysctl.conf.

See patchwork.kernel.org for more information.

To avoid link rot, the leading summary paragraphs on symbolic links from the hyperlink follow.

Kees Cook - July 2, 2012, 8:17 p.m.

This adds symlink and hardlink restrictions to the Linux VFS.

Symlinks:

A long-standing class of security issues is the symlink-based time-of-check-time-of-use race, most commonly seen in world-writable directories like /tmp. The common method of exploitation of this flaw is to cross privilege boundaries when following a given symlink (i.e. a root process follows a symlink belonging to another user). For a likely incomplete list of hundreds of examples across the years, please see: http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=/tmp

The solution is to permit symlinks to only be followed when outside a sticky world-writable directory, or when the uid of the symlink and follower match, or when the directory owner matches the symlink's owner.

  • hum.. yes sudo sysctl fs.protected_symlinks is 1... I try sudo sysctl -w fs.protected_symlinks=0 and ... Perfect! more /tmp/file.txt works! Ok... As it is danger, rapidly sudo sysctl -w fs.protected_symlinks=1 (and permission denied back as expected)... Well, no other workaround? I can't do a cp for a file that changes all time.... – Peter Krauss Jan 11 '17 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.