Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Suppose I have a directory with no access for anyone except for root. Am I guaranteed that everything in the directory is inaccessible to everyone but root? In other words, are file permissions hierarchical, so that if a user can't access a directory, they can't access anything in it, even if they have permissions to something in the directory?

share|improve this question
add comment

migrated from stackoverflow.com Jun 27 '11 at 16:02

This question came from our site for professional and enthusiast programmers.

3 Answers

Wiile the answer is mostly "yes", there are special cases in which is can be "no".

Because unix files are not guaranteed to have a unique path. So if you have

$ ls -l
drwx------- 1 root  root [...] root_only

and

$ ls -l root_only
-rw-rw-rw-- 2 root  root [...] hopefully_private_file

and hopefully_private_file is hardlinked from elsewhere it may be universally readable.

How do you know? Look again at that ls -l:

$ ls -l root_only
-rw-rw-rw-- 2 root  root [...] hopefully_private_file
            ^
            |

The number over the arrow is the link count (for files, it has a different meaning for directories). If the link count is 1 you are safe; if it is something else there may be a problem.

share|improve this answer
    
That's not really fair. Even if the file is hardlinked (and therefore accessible) from somewhere else, you still can't access it from the disallowed path. If the owner of the file hardlinked it from an accessible path, that implies that they understand that now there are two ways of accessing that file. –  Adam Batkin Jun 27 '11 at 17:26
    
@Adam, that really depends on what Echostar is trying to achieve here. But people need to be aware of this if they are to understand what the can can can not assume about file accessibility on unix systems. Of course, chmod 600 hopefully_private_file solves the problem. –  dmckee Jun 27 '11 at 17:29
add comment

To display something in the directory dir/ you need +x permission to be able to locate the inode of the file. So if you don't have +x, you can't read a file even if it is 777.

share|improve this answer
    
Hardlinks to the files can break this guarantee. See my answer. –  dmckee Jun 27 '11 at 17:11
add comment

That is correct, removing permissions on a parent directory affects the ability to work with anything within that directory.

If a user does not have execute permission on a directory, they will not be able to see access any files in a directory.

You probably also want to remove the read permission on the directory, so that they won't be able to even see the contents (filenames) of the directory.

share|improve this answer
    
Unless some of the files are hardlinked from a path the user can read. See my answer. –  dmckee Jun 27 '11 at 17:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.