Subject: Normal user with root power

From: [email-masked] (Robert Chea)
Date: Sun, 5 May 1996 20:25:54 -0700

Hi,

I'm running into a bizarre problem with my normal users.  When they log
into their directory, they can see all of the dot (.) files in there, even
though they don't have read permissions.  For example, a normal user can
see a .rhosts file in their directory with the following permissions:

-r--------   1 root     root          0 May  5 19:29 .rhosts

How is this possible?  I'm using the ls that comes with wu-ftpd.  In
addition to seeing the file, the user can actually  DELETE it with the
command , "del .rhosts"   !!!!  Why is the ftpd user so powerful?  I mean,
if if I did mess up permissions elsewhere (which i don't think I've done),
shouldn't root be the only one who can delete that file, much less see it?

The users are members of a guestgroup so they get chrooted to a directory
when they log in.  This happens with wu-ftpd2.4.2 beta10 on solaris 2.3 and
beta11 on solaris 2.5.

Does anyone know what's up?

Robert S. Chea
Director of Information Systems
[email-masked]

Phone:  (408) 261-6222
Fax:  (408) 261-6226

---

From: Brian Harvell <[email-masked]>
Date: Sun, 5 May 1996 23:57:55 -0400 (EDT)

> shouldn't root be the only one who can delete that file, much less see it?

It depends on the perms and owner of the directory.  The owner of the 
directory can delete files under it even if they are not owned by this person.
or if the directory has world write perms.

If your OS supports it you might want to look into setting the sticky bit on
the directory.  This would keep people from deleting the files unless they own
them.

Brian			
[email-masked]	iNet Communications	http://www.inet.net/~harvell

---

From: Michael Brennen <[email-masked]>
Date: Sun, 5 May 1996 23:05:32 -0500 (CDT)

> -r--------   1 root     root          0 May  5 19:29 .rhosts

Seeing the contents of a directory has to do with the permissions on the
*directory*, not the files in the directory.  Given permissions of rwx, if
the r bit is set for a particular user, users can see all contents
regardless of file settings.  If the w bit is set on a directory, files
can be deleted regardless of permission setting if ownership permits.  The
x bit must be set to access the contents at all. 

You may want to set the sticky bit (1xxx permissions) on the directory so
only the owner of a file can delete it. 

   -- Michael

---

From: Marc Rovner <[email-masked]>
Date: Mon, 6 May 1996 09:43:25 -0700 (PDT)

-]I'm running into a bizarre problem with my normal users.  When they log
-]into their directory, they can see all of the dot (.) files in there, even
-]though they don't have read permissions.  For example, a normal user can
-]see a .rhosts file in their directory with the following permissions:
-]
-]-r--------   1 root     root          0 May  5 19:29 .rhosts
-]
-]How is this possible?

Permission to see a file is given by the directory.  Permission to read
a file is given by the file.  Just because a file isn't readable doesn't
mean the user can't see it, and visa-versa.

If you want to keep a user from seeing a file, you need to remove read
permission from that directory. 

For ftp, you could also make the anonymous directory something other than
the ftp account's home directory.

-]                                                                  In
-]addition to seeing the file, the user can actually  DELETE it with the
-]command , "del .rhosts"   !!!!  Why is the ftpd user so powerful?  I mean,
-]if if I did mess up permissions elsewhere (which i don't think I've done),
-]shouldn't root be the only one who can delete that file, much less see it?

Again, this has to do with the directories permissions.  If a user has
write access on a directory, he can delete the files in that directory,
regardless of ownership or permission.

-]The users are members of a guestgroup so they get chrooted to a directory
-]when they log in.  This happens with wu-ftpd2.4.2 beta10 on solaris 2.3 and
-]beta11 on solaris 2.5.

A solution for your problem would be to chroot the user into something other
than the guest's home directory, say ~guestid/ftp.  This would allow you to
separate out what is ftp accessable and what is not for those account,
includning the dot files.

						- Marc David Rovner

						  Systems Administrator
						  Cygnus Support