[774] in linux-security and linux-alert archive
Re: [linux-security] standard users,groups,perms?
daemon@ATHENA.MIT.EDU (Joseph S. D. Yao)
Tue Jun 11 11:49:01 1996
Date: Mon, 10 Jun 1996 13:44:03 -0400
From: "Joseph S. D. Yao" <jsdy@cais.cais.com>
To: adamp@mickey.ovid.com, jsdy@cais.cais.com
Cc: jjr@zilker.net, linux-security@tarsier.cv.nrao.edu
> Date: Sat, 8 Jun 1996 05:31:32 -0600 (MDT)
> From: Adam Prato <adamp@mickey.ovid.com>
> Subject: Re: [linux-security] standard users,groups,perms?
> I dont see how root 'ownership' plays into this. The owner of a file means
> that this userid is the only one who can make changes to the file itself.
> Could you please explain the benefits of not having root owned files on a
> system? This concept seems to elude me.
Not true: the super-user account, which in recent (last 20 years ;-))
versions of Unix has been called "root", has all reasonable accesses to
a regular file on a regular disk file system, even though it might not
"own" the file.
Hence some people fall into the trap of doing everything su'ed to or
logged in as "root".
Hence all files thus created or copied become owned by root.
Which then seems to be the natural order of things for these people.
Since all things are owned by root, they and their successors then get
into or stay in the habit of doing all things su'ed to or logged in as
"root".
And when they accidentally do, from the directory they thought was /tmp
but is really /, an "rm -rf .[A-Za-z]* *", all they can say is "well,
it couldn't be helped."
The same when they copy a file into /dev/hda.
The same when they do anything which a sane set of permissions and
user/group "ownership"s might have prevented, but which ownership by
"root" and thus, necessarily, modification as "root" does little to
prevent.
This is what I try to prevent by making things not owned by "root".
It's not that they are owned by "root" that causes me grief. It's that
people then have to do maintenance to them as "root".
And, yes, if you have to routinely distribute tasks in a fixed and
predictable manner, then tools such as 'sudo' help. If you trust them.
[;-)/2]
Joe Yao jsdy@cais.com - Joseph S. D. Yao
