Remove the executable flag from the directory ( u-x) and the owner will lose ability to cd into that directory.Īt the same time - these files and directories can access by other people ( o+r and o+x). Remove the user-read flag from it and the owner of the directory would not be able to ls it. If you do that - the only way to read the file would be to elevate your privileges or return read flag back ( u+r). To set a file owned by user, but not readable by the same user is actually very easy: chmod u-r file The user can't see the process's memory maps through /proc/$pid/map* in case they reflected confidential information (and also to keep ASLR effective). The user can't dump the process's memory through /proc/$pid/mem. And so, for example, the user can't see what /proc/$pid/cwd points to, in case the process had changed to a directory that the user normally can't access. However, because the process may have had access to confidential information while it had the extra group privileges, the kernel no longer allows the user to perform operations that could exfilter this information. This process will have all files in /proc owned by the expected user and the permissions will be the same as for unprivileged processes. For example, consider a process that's running setgid. This is not reflected in the permissions. In particular, if a process is or has been running with elevated credentials (typically setuid or setgid, some information in /proc is not accessible to the user anymore, only to root. Separately, when a process lists a directory, the kernel generates permissions which are an approximation of the checks performed when opening a file. The kernel applies specific checks, which are different for different files in /proc. what user it's running as and so on), reads the file's permissions, and checks whether the credentials give access to the file. With “ordinary” filesystems, when a process opens a file (or lists a directory, or reads a symbolic link's target), the kernel checks the process's credentials (i.e. However, this doesn't explain what you're seeing in /proc. It's just a consequence of how permissions work. This is not useful for security since the owner can change the file's permissionsĪt any time. w-rw-r- 1 gilles gilles 6 Oct 20 15:13 foo You can remove the read permission from a file you own, and then you won't be able to read it anymore.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |