Linux permissions!

Question

I have /usr/bin/firefox with permissions : rwxrwxrwx owner : root group : root

I am 'user' on my system. When I run firefox, and do a: ps -ef| grep firefox I find that the owner of the process is 'user'.

Now, when this firefox process tries to open a html file with permissions : ---rwxrwx owner : root group : root

should it be able to read the file?

Moreover, to render this file on the screen, does the browser need read or execute permission?

Answer 1

It should be able to read the file. You are probably neither root user nor root group, so your permissions are the "other" set, which is the last 3 characters. You have an 'r', so you can read.

To render the file. the browser needs just read permissions.

Answer 2

Anyone including root is able to open an html file having the unusual permissions "---rwxrwx root root"

The first "---" are indeed useless in that case as root is not subject to access restrictions.

Answer 3

It is also important to mention the permissions on the directory in which the file resides. In order to be able to access the directory, the user should have an execute permission on it.

Answer 4

I believe that, if firefox the file is owned by root, but firefox the process is owned by "user", and your permissions are none for the owner, then firefox will work fine when running as root, since access restrictions don't count, but firefox won't be able to do much of anything running as "user".

More to the point: "everyone" will be able to do whatever they want to the file or the process, but the owner (if he's not root) won't be able to do anything at all.

I could be wrong, though...

Answer 5

The UID (what you are calling "process owner") is what counts when opening files - since you say Firefox is running as "user", that's the user we use when determining if the Firefox process has access to something.

If we have a file:

---rwxrwx owner : root group : root

Since we are "user", and "user" is not the owner or the group, we are the other. Read permission is get for other, and thus, we can read this file.

Finally, you note that /usr/bin/firefox is:

rwxrwxrwx owner : root group : root

...this is typically incorrect. As another poster noted, since I have write access, I can overwrite firefox with anything I want - potentially even another program! Typically, things in /usr/bin are rwxr-xr-x, so that only root can read/write them. (There are a few exceptions.)