When are Unix directory permissions enforced

Question

Say I have a directory that only root can access:

 $ sudo -s
 $ mkdir ~/rootonly
 $ chmod 000 ~/rootonly

Inside that directory is one with global-everything permissions:

 $ cd ~/rootonly
 $ mkdir openforall
 $ chmod 777 openforall

No if I want to access that directory as a normal user, I seemingly can't (as I would expect):

 $ su me
 $ cd ~/rootonly/openforall/
 bash: cd: /home/me/rootonly/openforall: Permission denied
 $ touch ~/rootonly/openforall/foo
 touch: cannot touch `/home/me/rootonly/openforall/foo': Permission denied

However, if I first cd as root into the directory, and then su to the normal user user, it does work:

 $ sudo -s
 $ cd /home/me/rootonly/openforall
 $ su www-data
 $ touch test
 $ ls
 $ -rw-r--r-- 1 www-data www-data 0 2011-08-05 14:17 test

Why does this work? Is the first case just a specific behavior of "cd", which tries to go through the directory hierarchy folder by folder? In other words, for an attacker bypassing the bash, does the kernel provide an entry to access "openforall" if the path is known?

I'm interested what is going on behind the scenes here.

Answer 1

The permisions are enforced when a command needs to "traverse" a directory.

When you touch ~/rootonly/openforall/foo, the touch command needs to open the rootonly directory so that it can find the location (inode etc) of openforall so that it can then edit the contents of the openforall directory structure to set the timestamp there of foo.