📄 ch22_11.htm

📁 the unix power tools
💻 HTM
字号:
<HTML><!--Distributed by F --><HEAD><TITLE>[Chapter 22] 22.11 A Loophole: Modifying Files Without Write Access</TITLE><METANAME="DC.title"CONTENT="UNIX Power Tools"><METANAME="DC.creator"CONTENT="Jerry Peek, Tim O'Reilly &amp; Mike Loukides"><METANAME="DC.publisher"CONTENT="O'Reilly &amp; Associates, Inc."><METANAME="DC.date"CONTENT="1998-08-04T21:40:31Z"><METANAME="DC.type"CONTENT="Text.Monograph"><METANAME="DC.format"CONTENT="text/html"SCHEME="MIME"><METANAME="DC.source"CONTENT="1-56592-260-3"SCHEME="ISBN"><METANAME="DC.language"CONTENT="en-US"><METANAME="generator"CONTENT="Jade 1.1/O'Reilly DocBook 3.0 to HTML 4.0"><LINKREV="made"HREF="mailto:online-books@oreilly.com"TITLE="Online Books Comments"><LINKREL="up"HREF="ch22_01.htm"TITLE="22. File Security, Ownership, and Sharing"><LINKREL="prev"HREF="ch22_10.htm"TITLE="22.10 cx, cw, c-w: Quick File Permission Changes "><LINKREL="next"HREF="ch22_12.htm"TITLE="22.12 A Directory that People Can Access but Can't List "></HEAD><BODYBGCOLOR="#FFFFFF"TEXT="#000000"><DIVCLASS="htmlnav"><H1><IMGSRC="gifs/smbanner.gif"ALT="UNIX Power Tools"USEMAP="#srchmap"BORDER="0"></H1><MAPNAME="srchmap"><AREASHAPE="RECT"COORDS="0,0,466,58"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="467,0,514,18"HREF="jobjects/fsearch.htm"ALT="Search this book"></MAP><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_10.htm"TITLE="22.10 cx, cw, c-w: Quick File Permission Changes "><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.10 cx, cw, c-w: Quick File Permission Changes "BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><B><FONTFACE="ARIEL,HELVETICA,HELV,SANSERIF"SIZE="-1">Chapter 22<BR>File Security, Ownership, and Sharing</FONT></B></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_12.htm"TITLE="22.12 A Directory that People Can Access but Can't List "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.12 A Directory that People Can Access but Can't List "BORDER="0"></A></TD></TR></TABLE>&nbsp;<HRALIGN="LEFT"WIDTH="515"TITLE="footer"></DIV><DIVCLASS="SECT1"><H2CLASS="sect1"><ACLASS="title"NAME="UPT-ART-3000">22.11 A Loophole: Modifying Files Without Write Access</A></H2><PCLASS="para"><ACLASS="indexterm"NAME="AUTOID-24356"></A><ACLASS="indexterm"NAME="AUTOID-24359"></A><ACLASS="indexterm"NAME="AUTOID-24362"></A>No one said that<SPANCLASS="link">UNIX is perfect (<ACLASS="linkend"HREF="ch01_34.htm"TITLE="What's Wrong with UNIX ">1.34</A>)</SPAN>,and one of its nagging problems has always been security. Here's oneglitch that you should be aware of. If you don't have write access toa file, you can't modify it. However, if you have write access to thedirectory, you can get around this as follows:</P><PCLASS="para"><BLOCKQUOTECLASS="screen"><PRECLASS="screen">% <CODECLASS="userinput"><B>ls -l unwritable</B></CODE>-r-r-r-  1 john         334 Mar 30 14:57 unwritable% <CODECLASS="userinput"><B>cat &gt; unwritable</B></CODE>unwritable: permission denied% <CODECLASS="userinput"><B>cat unwritable &gt; temp</B></CODE>% <CODECLASS="userinput"><B>vi temp</B></CODE>   ...% <CODECLASS="userinput"><B>mv temp unwritable</B></CODE>override protection 444 for unwritable? <CODECLASS="userinput"><B>y</B></CODE>% <CODECLASS="userinput"><B>cat unwritable</B></CODE>John wrote this originally, and made the file read-only.But then Mike came along and wrote:I should not have been able to do this!!!</PRE></BLOCKQUOTE></P><PCLASS="para">I couldn't write the file <EMCLASS="emphasis">unwritable</EM> directly. But I was able to copyit, and then use <EMCLASS="emphasis">vi</EM> to make whatever changes I wanted. Afterall, I had read access, and to copy a file, you only need to be ableto read it. When I had my own copy, I could (of course) edit it to myheart's content. When I was done, I was able to <EMCLASS="emphasis">mv</EM> the new fileon top of <EMCLASS="emphasis">unwritable</EM>. Why? Renaming a file only requires thatyou be able to write the file's directory. You don't need to be ableto write the file itself. (Note that a <EMCLASS="emphasis">cp</EM> wouldn'twork&nbsp;- copying requires <EMCLASS="emphasis">unwritable</EM> to be writable, if it alreadyexists.)This is one reason to watch directory access fairly closely.</P><PCLASS="para">As you can see, allowing directory-write access to others can bedangerous.If this is a problem for you, solve it by setting your<SPANCLASS="link"><EMCLASS="emphasis">umask</EM> (<ACLASS="linkend"HREF="ch22_04.htm"TITLE="Setting an Exact umask ">22.4</A>)</SPAN>correctly and using<SPANCLASS="link"><EMCLASS="emphasis">chmod</EM> (<ACLASS="linkend"HREF="ch22_07.htm"TITLE="Using chmod to Change File Permission ">22.7</A>)</SPAN>to fix permissions of existing directories.Or, you may be able to leave the directory writable and<SPANCLASS="link">set the directory's sticky bit (<ACLASS="linkend"HREF="ch22_06.htm"TITLE="Protecting Files with the Sticky Bit ">22.6</A>)</SPAN>.</P><DIVCLASS="sect1info"><PCLASS="SECT1INFO">- <SPANCLASS="authorinitials">ML</SPAN></P></DIV></DIV><DIVCLASS="htmlnav"><P></P><HRALIGN="LEFT"WIDTH="515"TITLE="footer"><TABLEWIDTH="515"BORDER="0"CELLSPACING="0"CELLPADDING="0"><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_10.htm"TITLE="22.10 cx, cw, c-w: Quick File Permission Changes "><IMGSRC="gifs/txtpreva.gif"SRC="gifs/txtpreva.gif"ALT="Previous: 22.10 cx, cw, c-w: Quick File Permission Changes "BORDER="0"></A></TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><ACLASS="book"HREF="index.htm"TITLE="UNIX Power Tools"><IMGSRC="gifs/txthome.gif"SRC="gifs/txthome.gif"ALT="UNIX Power Tools"BORDER="0"></A></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172"><ACLASS="SECT1"HREF="ch22_12.htm"TITLE="22.12 A Directory that People Can Access but Can't List "><IMGSRC="gifs/txtnexta.gif"SRC="gifs/txtnexta.gif"ALT="Next: 22.12 A Directory that People Can Access but Can't List "BORDER="0"></A></TD></TR><TR><TDALIGN="LEFT"VALIGN="TOP"WIDTH="172">22.10 cx, cw, c-w: Quick File Permission Changes </TD><TDALIGN="CENTER"VALIGN="TOP"WIDTH="171"><ACLASS="index"HREF="index/idx_0.htm"TITLE="Book Index"><IMGSRC="gifs/index.gif"SRC="gifs/index.gif"ALT="Book Index"BORDER="0"></A></TD><TDALIGN="RIGHT"VALIGN="TOP"WIDTH="172">22.12 A Directory that People Can Access but Can't List </TD></TR></TABLE><HRALIGN="LEFT"WIDTH="515"TITLE="footer"><IMGSRC="gifs/smnavbar.gif"SRC="gifs/smnavbar.gif"USEMAP="#map"BORDER="0"ALT="The UNIX CD Bookshelf Navigation"><MAPNAME="map"><AREASHAPE="RECT"COORDS="0,0,73,21"HREF="../index.htm"ALT="The UNIX CD Bookshelf"><AREASHAPE="RECT"COORDS="74,0,163,21"HREF="index.htm"ALT="UNIX Power Tools"><AREASHAPE="RECT"COORDS="164,0,257,21"HREF="../unixnut/index.htm"ALT="UNIX in a Nutshell"><AREASHAPE="RECT"COORDS="258,0,321,21"HREF="../vi/index.htm"ALT="Learning the vi Editor"><AREASHAPE="RECT"COORDS="322,0,378,21"HREF="../sedawk/index.htm"ALT="sed &amp; awk"><AREASHAPE="RECT"COORDS="379,0,438,21"HREF="../ksh/index.htm"ALT="Learning the Korn Shell"><AREASHAPE="RECT"COORDS="439,0,514,21"HREF="../lrnunix/index.htm"ALT="Learning the UNIX Operating System"></MAP></DIV></BODY></HTML>
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -