Say I have a directory that only root can access:
$ sudo -s $ mkdir ~/rootonly $ chmod 000 ~/rootonly
Inside that directory is one with global-everything permissions:
$ cd ~/rootonly $ mkdir openforall $ chmod 777 openforall
No if I want to access that directory as a normal user, I seemingly can't (as I would expect):
$ su me $ cd ~/rootonly/openforall/ bash: cd: /home/me/rootonly/openforall: Permission denied $ touch ~/rootonly/openforall/foo touch: cannot touch `/home/me/rootonly/openforall/foo': Permission denied
However, if I first cd as root into the directory, and then su to the normal user user, it does work:
$ sudo -s $ cd /home/me/rootonly/openforall $ su www-data $ touch test $ ls $ -rw-r--r-- 1 www-data www-data 0 2011-08-05 14:17 test
Why does this work? Is the first case just a specific behavior of "cd", which tries to go through the directory hierarchy folder by folder? In other words, for an attacker bypassing the bash, does the kernel provide an entry to access "openforall" if the path is known?
I'm interested what is going on behind the scenes here.