Unit 5: Permissions · Lesson 1 of 6 · 16 min

Reading permission strings

Ten characters decide who can read, write and run a file.

mission

You are
You are checking how the shop app's secrets are protected.
Situation
The app config folder holds two files. One contains the database password.
Goal
Read the permissions of both files and decide which is exposed.
Hand in
The octal mode of each config file.

A permission string

-rw-r--r--
  1. 1-type: - file, d directory, l link
  2. 2rw-owner
  3. 3r--group
  4. 4r--everyone else

Flip the bits

Click a bit to flip it
owner
= 6
group
= 4
others
= 4
$ chmod 644 db.env
$ stat -c '%a %A %n' db.env
644 -rw-r--r-- db.env

Everyone can read it. Fine for public files, wrong for secrets.

Read is 4, write is 2, execute is 1. Each digit is a sum.
01

Read the app config

learner@root-lab
stat -c '%A %U %G %n' /srv/app/config/*
-rw-r----- deploy ops /srv/app/config/app.env
-rw-r--r-- deploy ops /srv/app/config/db.env
stat -c '%a %n' /srv/app/config/db.env /srv/app/config/app.env
644 /srv/app/config/db.env
640 /srv/app/config/app.env

you should see app.env is 640 and keeps others out. db.env is 644: everyone can read it.

02

Prove it

learner@root-lab
cat /srv/app/config/app.env
cat: /srv/app/config/app.env: Permission denied
cat /srv/app/config/db.env
DB_HOST=10.20.0.12
DB_NAME=shop
DB_USER=shop_app
DB_PASSWORD=lab-only-not-a-real-secret

you should see Any account on the machine, including a compromised web process, can read the database password.

03

Find every file others can read

-perm -o+r matches files with the read bit for others set.

learner@root-lab
ls -l /srv/app/config
total 8
-rw-r----- 1 deploy ops 48 Oct 14 09:00 app.env
-rw-r--r-- 1 deploy ops 88 Oct 14 09:00 db.env
find /srv/app/config -perm -o+r -type f
/srv/app/config/db.env

you should see Only db.env, the file with the database password.

What a defender takes away

  1. 1Three sets of rwx: owner, group, others.
  2. 2Octal digits are sums of 4, 2 and 1.
  3. 3Secrets are never readable by others.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    stat -c '%a'

  2. Show hint

    cat it.