Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Say I have a directory that only root can access:

 $ sudo -s
 $ mkdir ~/rootonly
 $ chmod 000 ~/rootonly

Inside that directory is one with global-everything permissions:

 $ cd ~/rootonly
 $ mkdir openforall
 $ chmod 777 openforall

No if I want to access that directory as a normal user, I seemingly can't (as I would expect):

 $ su me
 $ cd ~/rootonly/openforall/
 bash: cd: /home/me/rootonly/openforall: Permission denied
 $ touch ~/rootonly/openforall/foo
 touch: cannot touch `/home/me/rootonly/openforall/foo': Permission denied

However, if I first cd as root into the directory, and then su to the normal user user, it does work:

 $ sudo -s
 $ cd /home/me/rootonly/openforall
 $ su www-data
 $ touch test
 $ ls
 $ -rw-r--r-- 1 www-data www-data 0 2011-08-05 14:17 test

Why does this work? Is the first case just a specific behavior of "cd", which tries to go through the directory hierarchy folder by folder? In other words, for an attacker bypassing the bash, does the kernel provide an entry to access "openforall" if the path is known?

I'm interested what is going on behind the scenes here.

share|improve this question
add comment

1 Answer 1

The permisions are enforced when a command needs to "traverse" a directory.

When you touch ~/rootonly/openforall/foo, the touch command needs to open the rootonly directory so that it can find the location (inode etc) of openforall so that it can then edit the contents of the openforall directory structure to set the timestamp there of foo.

share|improve this answer
    
So, it is not possible then to open a file directly solely with knowledge of it's inode? Why does it work when using su? Is there some kind of directory file handle inherited to the child process? That does't seem right; AFAIK file handles are not generally inherited. –  miracle2k Aug 7 '11 at 11:11
    
1. See man open. 2. If you break the operation into stages and have different effective user ids for each stage, the permissions apply per stage. Files can be opened using relative paths that do not require reading of parent directories. 3. No, only cwd. 4. Correct. –  RedGrittyBrick Aug 7 '11 at 15:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.