Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I wanted to know if someone got access to my server by using a nonroot account, how much damage can he do?

After i su someuser I used this command to find all files and folders that are writeable.

find / -writable >> list.txt

Here is the result. Its most /dev/something and /proc/something and these

/var/lock
/var/run/mysqld/mysqld.sock
/var/tmp
/var/lib/php5

Is my system secure? /var/tmp makes sense but i am unsure why this user has write access to those folders. Should i change them?

stat /var/lib/php5 gives me 1733 which is odd. Why write access? why no read? is this some kind of weird use of a temp file?

share|improve this question

1 Answer 1

Users will require access to certain system level areas in order to run certain software. For instance the /var/run/mysqld/mysqld.sock has to be accessable for them to be able to interact with databases.

/var/run in general has run-time data such as unix sockets and pid files.

/var/lock contains lock files to allow software to prevent read/write collisions etc and to allow exclusive open of files (file locking etc).

The /var/lib/php5 has a very special file access mode - 1733 - the 1 at the beginning is important:

From man chmod

       1000    (the sticky bit).  See chmod(2) and sticky(8).

So, from man sticky we get:

STICKY DIRECTORIES
     A directory whose `sticky bit' is set becomes an append-only directory,
     or, more accurately, a directory in which the deletion of files is
     restricted.  A file in a sticky directory may only be removed or renamed
     by a user if the user has write permission for the directory and the user
     is the owner of the file, the owner of the directory, or the super-user.
     This feature is usefully applied to directories such as /tmp which must
     be publicly writable but should deny users the license to arbitrarily
     delete or rename each others' files.

What that means is that it is a special security mode which allows a user to create or edit files in a directory, but only the owner of the file itself is able to delete it.

share|improve this answer
    
I think i'll accept this. When it allows me to –  acidzombie24 Mar 8 '11 at 22:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.