Re: SECURITY HOLE in namei.c ??

Gerd Knorr (kraxel@cs.tu-berlin.de)
Mon, 2 Sep 1996 19:25:46 +0200 (MET DST)


On Mon, 2 Sep 1996, Matt Hawkins wrote:

> On Sun, 1 Sep 1996, Herbert Rosmanith wrote:
>
> > > I may be wrong or have passed this theme, but how is it possible for a
> > > user to delete Files and Dirs, for them he has no write permissions!!
> >
> > if the user owns the directory, that's legal. this is unix, not vms.
>
> Said user could also be the 'superuser' - or this this special case
> handled differently?
>
If a user has write permissions to a directory, he is allowed to create
and delete files. One exeption: If you turn on the sticky bit for a
directory, someone can only delete his own files. Very useful for /tmp:

felix www /var/tmp$ ls -la
total 5
drwxrwxrwt 2 root root 2048 Sep 2 19:20 ./
^ sticky is on
drwxr-xr-x 11 root root 1024 Mar 18 10:43 ../
-rw-rw-rw- 1 kraxel all 4 Sep 2 19:05 .817.1807
-rw-rw-rw- 1 kraxel all 4 Sep 2 18:57 .817.3807
-rw-r--r-- 1 root root 0 Sep 2 19:20 .crond_running
lrwxrwxrwx 1 root root 15 Sep 2 08:51 gpmctl ->
/var/run/gpmctl=
felix www /var/tmp$ rm .817.1807
rm: remove `.817.1807'? y
rm: .817.1807: Operation not permitted
felix www /var/tmp$

Gerd