0

I'm refering to the following Arch Linux Access_Control_Lists documentation

It states:

Granting execution permissions for private files to a web server

The following technique describes how a process like a web server can be granted access to files that reside in a user's home directory, without compromising security by giving the whole world access.

In the following we assume that the web server runs as the user http and grant it access to geoffrey's home directory /home/geoffrey.

The first step is granting execution permissions for the user http:

setfacl -m "u:http:--x" /home/geoffrey

Note: Execution permissions to a directory are necessary for a process to list the directory's content.

So, in the example above they are setting the execute permissions for the http user on the /home/geoffrey directory. Per my understanding granting only the execute bit on a directory will NOT allow you to list the content of a directory but it would allow you to access files (if you know their names + the permissions on given files within the directory would had the right permissions sets). So how is it possible that with setfacl -m "u:http:--x" /home/geoffrey the http user (or the process as they refer to) would be able to list the directory's content? What am I missing?

Thank you in advance!

2 Answers 2

3

You need -x permission on a directory in order to be able to access it and any files in it. However, your access to the files under the directory depends on the permissions of the files, not the directory itself. As long as you have execute rights on the parent (the directory), you don't need anything else to access the files it contains. This is most easily demonstrated by an example:

$ sudo mkdir dir1 && echo "Hello world!" | sudo tee dir1/file1 && sudo chmod 700 dir1
Hello world!
$ ls -ld dir1/
drwx------ 2 root root 4096 Apr 12 16:09 dir1/
$ sudo ls -l dir1/
total 4
-rw-r--r-- 1 root root 13 Apr 12 16:09 file1

Only root has access, so if we try to list the directory's contents or cat the file, it will fail:

$ ls dir1/
ls: cannot open directory 'dir1/': Permission denied
$ cat dir1/file1
cat: dir1/file1: Permission denied

Note how the cat fails even though I have read access to the file. Now, if I give my user execute access to the directory, and try again, I can read the file:

$ sudo chmod 711 dir1/
$ ls -l
total 4
drwx--x--x 2 root root 4096 Apr 12 16:09 dir1
$ cat dir1/file1
Hello world!

I still can't list the directory's contents since that would require read access to the directory, but I can now read any file in the directory as long as I know its path.

So, the basic idea is sound here, it's just that final note that is confusing. You need read access to list the contents, but execute access is sufficient if you only need to give the http user access to specific files whose path is known.

While badly phrased, the note isn't exactly wrong, as such, just incomplete. You do indeed need execute permissions in order to fully list a directory's contents. Without them, you can see file names but no attributes:

$ ls -l
total 4
drwxr--r-- 2 root root 4096 Apr 12 16:09 dir1
$ ls -l dir1/
ls: cannot access 'dir1/file1': Permission denied
total 0
-????????? ? ? ? ?            ? file1
4
  • 1
    "You do indeed need execute permissions in order to list a directory's contents. Without them, you can see file names but no attributes: " TBH i don't agree with you. As per their docs they set only the execute bit. The quoted sentence of yours would make sense if the read bit would also be set. You event state it yourself "I still can't list the directory's contents since that would require read access to the directory". Overall the Arch doc regarding this is badly worded.
    – user211245
    Apr 12, 2020 at 19:39
  • @user211245 yes it is indeed badly worded, no argument there.
    – terdon
    Apr 13, 2020 at 14:09
  • "I still can't list the directory's contents since that would require read access to the directory," ... "You do indeed need execute permissions in order to list a directory's contents." -- the first of these statements is correct. The 2nd is a contradiction. Turn off auto correct, and you will see it. (it is hard to turn off your own internal auto correct) Apr 13, 2020 at 14:10
  • 1
    @ctrl-alt-delor yes, I see your point now. I was taking "listing" as meaning "listing file names and attributes_". That's why I said you need execute permissions because "Without them, you can see file names but no attributes". But yes, you're probably right and "listing" just requires getting the file names.
    – terdon
    Apr 13, 2020 at 14:14
1

You are missing nothing: While most of this document is correct, the note is wrong.

It can cross your home directory, into another directory. That other directory may be readable and crossable, and therefore have its contents listed.

I think that making your home only crossable is a good idea, but I also think you are correct, the description of what it does is wrong.

  • You need read permission to list the file-names in a directory.
  • You need cross permission to stat the file (find out any thing about the file, or open it).

Have you submitted a bug report?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.