Unit 5: Permissions · Lesson 3 of 6 · 14 min
Directory permissions
On a directory, r, w and x mean something different.
mission
- You are
- You are explaining a strange access pattern to a colleague.
- Situation
- You cannot list /srv/app, yet you could read a file inside it.
- Goal
- Work out why from the directory bits.
rwx on a directory
- rlist the names inside
- wcreate, rename and delete entries
- xenter it and reach files by name
Read the directory modes
stat -c '%A %U %G %n' /srv/app /srv/app/config drwxr-x--x deploy ops /srv/app drwxr-xr-x deploy ops /srv/app/config ls /srv/app ls: cannot open directory '/srv/app': Permission denied ls /srv/app/config app.env db.env
you should see Others have only x on /srv/app: no listing, but a path you already know still works.
stat- Shows a file's size, owner, permissions and timestamps. Built into Linux and macOS.
ls- Lists the files in a folder. Built into Linux and macOS.
Least privilege done right
stat -c '%A %U %G %n' /etc/passwd /etc/shadow -rw-r--r-- root root /etc/passwd -rw-r----- root shadow /etc/shadow cat /etc/shadow cat: /etc/shadow: Permission denied
you should see Everyone can read the account list. Only root and the shadow group read the password hashes.
cat- Prints the contents of one or more files. Built into Linux and macOS.
A drop box
Write and execute without read lets others put files in but not list what is there.
mkdir -p /tmp/dropbox && chmod 733 /tmp/dropbox stat -c '%a %A %n' /tmp/dropbox 733 drwx-wx-wx /tmp/dropbox
you should see drwx-wx-wx: a one-way drop box.
mkdir- Creates folders. Built into Linux and macOS.
chmod- Changes a file's permissions. Built into Linux and macOS.
What a defender takes away
- 1r lists, w changes entries, x lets you through.
- 2x without r hides names but not known paths.
- 3Hiding a directory is not a substitute for protecting its files.
Questions
0 of 1 solved
Answer each one from what you find on your lab machine.