0

I am just curious because for ordinary user scripts I must check if the corresponding file is readable by the user and writable like this (just a snippet for the read operation):

if ! [ -r "$1" ]; then
    dump_args "$@"
    print_error__exit "! [ -r $1 ]" "The file is not readable by you!"
fi

My question is: Is on the whole Linux (if must be, say Mint or Debian) system any file not readable or not writeable by root?

My belief, in general, is that root can do anything, but everything has limits, right,... which is why I am asking this question. Thank you.

2
  • Also: unix.stackexchange.com/q/17402/70524 – muru May 2 at 9:03
  • One more example with the immutable attribute. To experiment, as root: touch test.txt && chattr +i test.txt && rm test.txt => test.txt: Operation not permitted (run chattr -i text.txt to revert) – Zeitounator May 2 at 10:57
4

Many files under /proc are not writable, and there are files under /sys that are writable but not readable. Examples:

echo something > /proc/$$/cmdline
cat /sys/block/sda/device/delete

(Be careful: echo > /sys/block/sda/device/delete will "detach" sda from the system)

This is so because /proc and /sys are special filesystems. It has nothing to do with the usual file permissions.

There are other examples:

  • read-only filesystems such as DVDROMs
  • filesystems that are mounted read-only
  • networked filesystems where root is not mapped to a high-privilege user, e.g. NFS with root squash
  • device files for devices that only allow reading or writing
2
  • For a non-Linux only example: Root may sometimes not access things on networked file systems depending on how the local root user is mapped on the remote server. – Kusalananda May 2 at 8:28
  • 1
    @Kusalananda I am stealing your comment. It also works for homogenous Linux networks; think of root squash in NFS. – berndbausch May 2 at 10:46
4

In addition to files under /proc and /sys, FUSE file systems are by default not accessible to root; see Why cannot find read /run/user/1000/gvfs even though it is running as root? for details.

It is also possible to set systems up with mandatory access control systems such as SELinux so that root is restricted. Russell Coker has (or used to have, I haven’t checked) a publicly-accessible play machine where anyone could log in as root, without being able to harm the system.

A process can run as root in a user namespace, without that granting actual root access on the host system. In a similar vein, remote file systems can have user mappings such that root on clients can’t access certain files or directories (or anything at all in some cases).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.