Lesson 2.5: Dangerous file permissions
The simplest way from a normal user to root: a file that root uses and anyone can change. A script root runs every night, a configuration file with a password readable by all, a service file that anyone can edit. How to find world-writable and world-readable files where they matter, what the right owner and mode are, and how umask decides the permissions of new files. In the lab you find a report script that root runs from cron and every user can rewrite, and a config file that shows a database password to everyone, then fix both and check again.
16 min
You will learn to
- Explain why writable root-owned paths lead to root
- Find world-writable files with find -perm
- Find secrets readable by everyone
- Fix owner and mode with chown and chmod
- Explain umask
Key terms
- Permission bits
- Read (r=4), write (w=2) and execute (x=1) for the owner, the group and others.
- World-writable
- A file or folder that 'others' (every user) can write.
- umask
- A mask that removes permissions from every new file and folder a process creates.
- Path hijacking
- Getting a privileged program to run your file by controlling a path it uses: a writable script, folder or PATH entry.
← MAC addresses, Ethernet and ARP · All lessons · The same-origin policy and CORS →