Re: slocate leaks filenames of protected directories Jan 10 2007 06:28PM
Dennis Jackson (dennis jackson ndirect co uk) (1 replies)
Re: slocate leaks filenames of protected directories Jan 11 2007 11:14AM
Ben Wheeler (b wheeler ulcc ac uk) (1 replies)
Re: slocate leaks filenames of protected directories Jan 11 2007 06:50PM
Dave Moore (dave j moore gmail com) (1 replies)
Re: slocate leaks filenames of protected directories Jan 12 2007 09:18PM
Ben Wheeler (b wheeler ulcc ac uk)
On Thu, Jan 11, 2007 at 12:50:49PM -0600, Dave Moore wrote:
> chmod 711 dir
> sets permissions: drwx--x--x
>
> But for directories the x doesn't mean executable, it means
> searchable.
...
>
> Or am I missing something?

You're missing what "searchable" means. It means you can cd into
the directory and you can access files within the directory *if*
you know their exact name (and have appropriate perms on those files)
but you *cannot* list the directory's contents. Thus if slocate
allows you to list the contents of such a directory just by
specifying the name of the directory, or a single character of
a file within the directory, it is laxer security than the directory
permissions allow. Not the world's most pressing security problem,
but a problem nonetheless.

Ben

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus