Re: [Security-Discuss] Xine accessing /etc/passwd ????

On Sun May 21 2006 04:08 pm, Vincent Danen wrote:
> No idea about xine, but if there is a root:root owned file in your
> homedir which is owned user:user, user will *always* be able to delete
> it, regardless of permissions because it has rwx access to the
> directory:
>
> vdanen@odin:~/ >% sudo su
> Password:
> odin:/Users/vdanen root# touch rootme
> odin:/Users/vdanen root# ls -l rootme
> -rw-r--r--    1 root     vdanen          0 May 21 14:06 rootme
> odin:/Users/vdanen root# chown root:admin rootme
> odin:/Users/vdanen root# chmod 600 rootme
> odin:/Users/vdanen root# ls -l rootme
> -rw-------    1 root     admin           0 May 21 14:06 rootme
> odin:/Users/vdanen root#
> odin:/Users/vdanen root# exit
> exit
> vdanen@odin:~/ >% ls -l rootme
> -rw-------    1 root     admin           0 May 21 14:06 rootme
> vdanen@odin:~/ >% cat rootme
> cat: rootme: Permission denied
> vdanen@odin:~/ >% rm rootme
> remove rootme? y
> vdanen@odin:~/ >% ls -l rootme
> ls: rootme: No such file or directory
> vdanen@odin:~/ >%
>
> The above is on my OS X box, but the principle is the same.

Thanks Vincent,
	completely forgot about access rights to the directory itself ;-)
Allthough you have to admit it is kind of counterintuitive !!

Thanks again.
____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________