up vote 3 down vote favorite
1
share [g+] share [fb]

I know root has very strong permissions in Unix, but I was wondering if it can circumvent the file permission system.

I have a directory whose owner is not root, the directory has permissions drwxr-xr-x. I know that the root user can delete files in this folder also after doing chown, chmod or something similar.

Can a root user also delete these files without doing any sort of chwon, chmod etc. (for example rm -f). Assume files itself have all permissions. I my opinion it should not be possible. This is an important production problem.

link|improve this question
feedback

2 Answers

up vote 7 down vote

Yes, root can delete any file regardless of its permissions. Anyone who can't be trusted with that privilege should not be given root access.

link|improve this answer
Thanks for answering. Can the root user delete the files in the scenarion I mentioned without using chgown (change owner), chmod (or something similar). As you know file permssions is irrelevant, what is relevant is directory permission. – Jim Dec 20 '11 at 16:23
To rephrase: Using the sceario I asked, assume the directory is mydir and file is myfile. Myfile has rwxrwxrwx, not owned by root. mydir has rwxr-xr-x and not owned by root. We have script which is owned by root and is run. The scripts tries to remove myfile with rm -f myfie. Two cases are possible with script: a) Do a chmod 777 mydir and then rm -f file and then chmod 755 mydir. b) just try rm-f myfile without any other steps. Wwill option b also work?? – Jim Dec 20 '11 at 16:29
2  
@Jim: To slightly rephrase what Mike said, root can delete any file regardless of any permissions. – grawity Dec 20 '11 at 16:46
Thanks grawity I get it. :-) I know I tend to be verbose. The question background. We have directories mydir and mydir/onemoredir in production whih belong to a non-root user. mydir has rwxr-xr-x and onemoredir has rwxrwxrwx. There is a script which runs a root. It is able to delete all files in onemoredir, but not in mydir. Thanks Jim – Jim Dec 20 '11 at 16:56
1  
Please edit your question to provide uname -a – kubanczyk Dec 20 '11 at 19:14
show 2 more comments
feedback
up vote 1 down vote

On traditional Unix systems that use discretionary access control (DAC) root can indeed delete any file with no regard to permissions. One exception that comes to mind is NFS-mounted directory (hosted on remote server), depending on exportfs root= option.

On modern mandatory access control (MAC) Unix-like systems, such as SELinux, root may be stripped of such special capability.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.