0

Im setting 444 permissions on a file, but still, Im able to rename files.

I tried it through php with the rename() function and in terminal with the mv command.

I list my file and it appears as -r--r--r-- 1

So my question is, for renaming files you dont need permissions so the file. I think this is a security concern since, someone without permissions could just change all my files names and break my system.

Improve this question

2 Answers 2

Reset to default
3

Renaming is done at the directory level. If a user has write permissions on a directory, they can rename files in that directory, even if they have no access to the files themselves.

e.g. the filename is stored in the directory "file". This is how hardlinks are accomplished, allowing one single file to have multiple filenames associated with it.

in other words, this is working as expected, and is not a "security concern".

Improve this answer
2
  • Not sure about your brief mention of how hardlinks works. Surely to explain that properly you need to introduce the concept of the inode and how (possibly multiple) names map to them in the directory file. I would remove the reference to hardlinks unless you can explain it better.
    – trojanfoe
    Jun 17, 2013 at 17:10
  • Thanks a lot for your answer, I really thought something was wrong with my environment, because most of the info I found was about having issues because I didnt had permissions and not the other way around.
    – user2494096
    Jun 17, 2013 at 22:59
0

Renaming the file changes the directory and not the file itself. Remove the w permissions from the directory to prevent it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .