jperezduerto.info
Security in depth · Unit 22 · Lesson 3 of 44
Owner, group, and other
Choose the applicable class before evaluating a requested operation.
Helpful before thisLinux privilege escalation
After this lesson you can
- Interpret owner, group, and other permissions for a stated process identity.
One idea. One situation. One reasoned decision.
How it works
Traditional Unix mode bits describe read, write, and execute permissions for owner, group, and other classes. These classes are selected according to the process identity; their permissions are not simply added together. ACLs, capabilities, mount settings, and mandatory policies can affect the final decision. Start with ownership and the requested operation, then consider the additional controls before concluding that an action is allowed.
Read the supplied record
This fictional record concerns an ordinary process with no privilege override, no extended ACL, and no additional policy affecting the result. All parent directories permit search.
| Recorded fact | Value |
|---|---|
| File owner | Maya |
| Owning group | Editors |
| Owner rights | Read |
| Group rights | Read and write |
| Other rights | None |
Maya’s process requests write access. The owner class applies, so the request fails this permission check. Membership in Editors does not make the check fall through to the group class. A different Editors member who is not the owner can instead match the group class.
The record describes permission, not whether anyone actually changed the document. A review should retain that distinction and identify any additional controls before applying the example to a real system.
The key distinction: Reading content and changing content are different operations.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Maya owns a file whose owner permissions are read-only and group permissions are read/write. Maya also belongs to that group. Under the stated assumptions, may her process write the file?
Show the answer
Correct answer: No. The owner class applies and lacks write permission. Maya matches the owner. Other group membership does not provide a fallback for the missing owner permission.
Try it
- WriteUsing the supplied record, write the selected permission class and result for Maya and for a different project-group member. State the assumptions that make each conclusion valid.