Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say I have a directory that only root can access:

 $ sudo -s
 $ mkdir ~/rootonly
 $ chmod 000 ~/rootonly

Inside that directory is one with global-everything permissions:

 $ cd ~/rootonly
 $ mkdir openforall
 $ chmod 777 openforall

No if I want to access that directory as a normal user, I seemingly can't (as I would expect):

 $ su me
 $ cd ~/rootonly/openforall/
 bash: cd: /home/me/rootonly/openforall: Permission denied
 $ touch ~/rootonly/openforall/foo
 touch: cannot touch `/home/me/rootonly/openforall/foo': Permission denied

However, if I first cd as root into the directory, and then su to the normal user user, it does work:

 $ sudo -s
 $ cd /home/me/rootonly/openforall
 $ su www-data
 $ touch test
 $ ls
 $ -rw-r--r-- 1 www-data www-data 0 2011-08-05 14:17 test

Why does this work? Is the first case just a specific behavior of "cd", which tries to go through the directory hierarchy folder by folder? In other words, for an attacker bypassing the bash, does the kernel provide an entry to access "openforall" if the path is known?

I'm interested what is going on behind the scenes here.

share|improve this question

The permisions are enforced when a command needs to "traverse" a directory.

When you touch ~/rootonly/openforall/foo, the touch command needs to open the rootonly directory so that it can find the location (inode etc) of openforall so that it can then edit the contents of the openforall directory structure to set the timestamp there of foo.

share|improve this answer
So, it is not possible then to open a file directly solely with knowledge of it's inode? Why does it work when using su? Is there some kind of directory file handle inherited to the child process? That does't seem right; AFAIK file handles are not generally inherited. – miracle2k Aug 7 '11 at 11:11
1. See man open. 2. If you break the operation into stages and have different effective user ids for each stage, the permissions apply per stage. Files can be opened using relative paths that do not require reading of parent directories. 3. No, only cwd. 4. Correct. – RedGrittyBrick Aug 7 '11 at 15:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.