4.4. Typical Rights-Assignment Mistakes

Assigning user access rights on a strictly as-needed basis can make your system significantly more secure. When the access rights are properly regulated , most break-in attempts will be ineffective . For example, once a bug was discovered in one of the Linux services. Thanks to my judicious rights assignment policy, my server was resistant to attacks exploiting this bug. Even if hackers had been able to log onto the server, they could not have changed or deleted anything, because all outside users of this service had only read rights.

So implementing a well-thought-out access rights policy may provide an impenetrable barrier for potential hackers.

Consider a classic example with files and directories. Suppose that directory access permissions are set to drwxrwxrwx (or 777), and all files in the directory have -rw------- permissions. Theoretically, a file can be modified only by the file owner, but this is not quite so. True, the hacker will not be able to change the file itself; however, he or she can read and write the documents in the directory. This allows the hacker to simply delete the necessary file and create a new one with the same name but with all access rights.

To prevent such a development, you must restrict access not only to files but also to directories.

There are, however, situations, in which directories have to have all permissions. This applies to shared directories used by users to exchange files. At the same time, only the administrator or file owners should be able to delete files in these directories. No user should have the right to delete other users' files. How can the problem of having a directory accessible to all, yet allowing only specific users to control their corresponding contents in it, be solved ?

Suppose you have a directory named shared. So that a file could be deleted by its owner, its sticky bit should be set. This is done by executing the chmod command with the +t option as follows :

 chmod +t shared

Examine the access rights to the directory by executing the ls -al command. It should display drwxrwxrwt . Note that in the triplet that indicates all other users' access rights, instead of the x character there stands a t character. It is this character that indicates that the sticky bit is set. Now try to delete from this directory a file belonging to another owner. This will result in the system issuing this message: "rm: cannot unlink 'file_name': Operation not permitted."

Set this bit for all open folders. When they cannot gain access to information, some malicious hackers vent their anger by deleting everything they come across. The sticky bit ensures that hackers can delete only objects that they have created.

In older Linux distributions, permissions for the /tmp directory, in which temporary data for all users are saved, are set to drwxrwxrwx . In modern distributions, this directory has the sticky bit set. Check this directory in your system, and if the sticky bit is not already set, set it yourself to prevent users from deleting temporary files that are not theirs.