Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unix file access rwx permissions are simple but tricky

igoro.pro

Post reply on HN
Print view View original

71–77 of 77 posts

Re: Unix file access rwx permissions are simple but tricky

#71

Post by pjmlp »

sim7c00 wrote: post #69
bloqs wrote: post #9

Earlier quoted context omitted.

Depressingly i think sharing computers at least in the western world has become a thing of the past. At the very least, sharing your main form of computing.

?? not all households have money to buy pc for everyone. for phones maybe (also less common outside of rich countries), but definitely not true for pc platform, for most of the world actually.. there a lot of pcs for the family still.

In poorer countries, the phone/tablet is the only "PC" they have, and I guess that was the point being made.

Re: Unix file access rwx permissions are simple but tricky

#72

Post by teo_zero »

inetknght wrote: post #28
teo_zero wrote: post #18

It's counterintuitive that the owner can have less rights than the others. Honestly, I've never seen it put in practice in any real-world file system. Incidentally, this is also not very efficient: UNIX permissions as they are today require 9 bits, namely rwx for owner, rwx for group, and rwx for others. But in an alternative universe where owner's rights win over group's rights which win over others' rights, permiss…

Alas, you're missing some bits. Sticky bit in particular can be associated to each of those too. There's probably others that I don't remember off the top of my head. > It's counterintuitive that the owner can have less rights than the others I completely concur. I've also never seen it used in the wild, but I know about it because I stumbled upon it more than once building scripts and not being careful about what fl…

> Alas, you're missing some bits.

Why "alas"? I'm comparing apples with apples: UNIX base permissions vs alternative-universe base permissions. If you want to add the 3 flags (sticky, setuid and setgid), you can add 3 bits to both sides of the comparison.

Re: Unix file access rwx permissions are simple but tricky

#73

Post by holowoodman »

tredre3 wrote: post #64
0cf8612b2e1e wrote: post #48

Earlier quoted context omitted.

It probably is fine. Still makes my spider sense tingle about some unforeseen failure that will crop up one day.

I've seen scripts with hardcoded "/home/$username" so your worries aren't entirely unfounded. It's understandable too, because Linux doesn't provide a nice way to retrieve that information. You'll have to parse /etc/passwd (which might not contain all users) or hope that whatever language you're using supports path extrapolations so that you can do realpath(~username) or call a third party tool that does, like a shel…

Of course there is a nice way. 'getent passwd' if you have a shell script, or the getpwent() libc function if you are in some real programming language somewhere. That is ages-old POSIX stuff from almost the last century even (POSIX.1-2001, actually older than the standard even, since it has been in SystemV and BSD...), and Linux has always supported that.

Re: Unix file access rwx permissions are simple but tricky

#74

Post by anthk »

ryandrake wrote: post #24
eadmund wrote: post #3

Earlier quoted context omitted.

Those multiple users could be used to implement sandboxing. And of course if one has a family then one might want accounts for Mom, Dad, Alice and Bob.

Yea, I'd like to see a system where each application runs as its own user, especially third party applications not vetted by the OS vendor, the package manager and so on. Maybe this already exists--I think it would be a good step forward for security and privacy. You can no longer trust 3rd party applications to stay in their lanes. Running an application with full access to everything that I as a user have access to…

Stop running 3rd party propietary crap. Problem solved. Better: separate your work, gaming/leisure and 'sensitiive' (banking) files with 3 different users.

Re: Unix file access rwx permissions are simple but tricky

#75

Post by anthk »

tredre3 wrote: post #64
0cf8612b2e1e wrote: post #48

Earlier quoted context omitted.

It probably is fine. Still makes my spider sense tingle about some unforeseen failure that will crop up one day.

I've seen scripts with hardcoded "/home/$username" so your worries aren't entirely unfounded. It's understandable too, because Linux doesn't provide a nice way to retrieve that information. You'll have to parse /etc/passwd (which might not contain all users) or hope that whatever language you're using supports path extrapolations so that you can do realpath(~username) or call a third party tool that does, like a shel…

$HOME.

Re: Unix file access rwx permissions are simple but tricky

#76

Post by jesprenj »

0cf8612b2e1e wrote: post #21
jesprenj wrote: post #19

Earlier quoted context omitted.

It took me a shockingly long amount of time before I realized it was silly to have a username on my machines. I am the only person using this, why am I typing unnecessary cruft? Username switched to “root” on all my machines and I remove the username from PS1. /root is shorter than /home/a (:

That requires faith in software not making hard coded assumptions about filesystem structure. Something which I am not prepared to do. How much software still cannot respect XDG?

ln -s /root /home/root

Re: Unix file access rwx permissions are simple but tricky

#77

Post by fuzztester »

emmelaich wrote: post #58
fuzztester wrote: post #33

Earlier quoted context omitted.

>Sticky bit Interestingly, I have come across some people who confuse the sticky bit with the setuid bit.

It's pretty common for people the misuse the terminology but not the semantics.

I have had some colleagues who did not get the semantics either, for many features of Unix permission bits, not just the two mentioned above.

For example, some did not know how to use the symbolic form of the chmod command's permission flags, e.g., like ug+rx, only the octal ones, like 660, and would typically indiscriminately use 777, not knowing about the security risks :)

Post reply on HN