Subject: Re: Normal user with root power

From: [email-masked] (Robert Chea)
Date: Mon, 6 May 1996 10:44:53 -0700

Hi Everybody,

Thanks for the prompt response to my question!  I really appreciate it.

>On Sun, 5 May 1996, Robert Chea wrote:
>
>> Hi,
>>
>> I'm running into a bizarre problem with my normal users.  When they log
>> into their directory, they can see all of the dot (.) files in there, even
>> though they don't have read permissions.  For example, a normal user can
>> see a .rhosts file in their directory with the following permissions:
>>
>> -r--------   1 root     root          0 May  5 19:29 .rhosts
>>
>> How is this possible?  I'm using the ls that comes with wu-ftpd.  In
>> addition to seeing the file, the user can actually  DELETE it with the
>> command , "del .rhosts"   !!!!  Why is the ftpd user so powerful?  I mean,
>> if if I did mess up permissions elsewhere (which i don't think I've done),
>> shouldn't root be the only one who can delete that file, much less see it?
>
>It depends on the perms and owner of the directory.  The owner of the
>directory can delete files under it even if they are not owned by this person.
>or if the directory has world write perms.
>
>If your OS supports it you might want to look into setting the sticky bit on
>the directory.  This would keep people from deleting the files unless they own
>them.
>
>
>Brian
>[email-masked]        iNet Communications     http://www.inet.net/~harvell

Robert S. Chea
Director of Information Systems
[email-masked]

Phone:  (408) 261-6222
Fax:  (408) 261-6226