4

Is it possible for a user who doesn't have permission to read a directory, but does have permission to read the files inside it, to access those files? If so, how?

Or, put another way: If I want to prevent a user from accessing files in a directory, is revoking that user's permissions for the directory sufficient, or do I have to revoke the user's permissions on all files in the directory as well?

4

It depends on the exact permissions the user has on the directory.
If the user is allowed to enter the directory (x), he can read files by accessing them with the filename. It is possible to brute-force filenames, of course. He can not list the files in the directory without having read permissions on it. He can, however, try possible filenames and compare the error messages. He will get Permission denied in case the file exists or No such file or directory, in case it doesn't, obviously.
If the user does not have the right to enter the directory (x), he is not able to read files in it at all.

| improve this answer | |
  • So there's no security risk in allowing everyone read permissions to sensitive files so long as the directory those files are in has permissions set appropriately? – Ajedi32 Dec 18 '13 at 21:14
  • Sorry, I'm not sure whether I understood your question correctly. Do you want to revoke read permissions on the directory but grant read permissions on the files inside the directory? Well, I wouldn't say there are no security risks. As I mentioned, it is possible to get access to the files by brute-forcing filenames. – Tim Zimmermann Dec 18 '13 at 21:19
  • Sorry, maybe I should have explained my reasons for asking this in my question. I'm not saying I want users to be able to read files in the protected directory, I'm just asking whether they can so I know whether I have to take extra precautions to prevent them from doing so. – Ajedi32 Dec 18 '13 at 21:25
  • Short answer: they can. If you don't want them to, revoke the permissions. – Tim Zimmermann Dec 18 '13 at 21:27
  • So which is it? Your answer says that they can't if they don't have read or execute permissions on the directory, but your comment says that they can. – Ajedi32 Dec 19 '13 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.