Picture a scenario in which you have a parent and a child directory. In the parent directory you have given group rwx. Below that directory you have a directory in which the group permissions are --- (so no permissions.) Is this secure? Why or why not?
This setup immediately struck me as not secure; my original thinking was that since group had all permissions in the parent directory, they can change the permissions of the child. But when we tested this theory it didn't work.
I created a directory Test and changed permissions with chmod 777 Test
; then, inside that directory, I created a directory ChildTest and set permissions with chmod 700 ChildTest
, thereby setting up the parameters in the question.
Then my friend cd'd into my Test directory and tried several different things to try to access ChildTest: (Our HP/UX environment uses ksh)
cp -R ChildTest ~
chmod 777 ChildTest
mkdir New
mv ChildTest New # (also tried this with cp)
All of which fail because he did not own ChildTest
. So we were thinking maybe it was more secure than we thought. We asked the professor, who again, alluded to the fact that it wasn't secure at all, but wouldn't give us any information more than "You need to do it with two people, because its too easy to change your own permissions" (which really confused us because... we were?)
So anyway, I'm sure that this set up is in fact not secure, but I just don't know how to prove it. I don't want the answer given to me, but maybe just a push in the right direction or confirmation that I'm on the right track would be great.