Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #209813

Re: How to set access permissions to protect a database file?

Show all headers | View raw

On 6/9/19 2:32 PM, Markos wrote:
> Many thanks to Mick, David and Joe,
> 
> To guarantee "some" protection to the file containing the database I 
> decided to use the following strategy:
> 
> I created, as root, the directory /home/reading_room
> 
> And activated the "sticky bit" of the reading_room directory with the 
> command:
> 
> chmod +t /home/reading_room/
> 
> And transferred, the files to the new directory with the following 
> access permissions:
> reading_room.tcl  rwxr--r-x  (owner markos)
> 
> reading_room.db rw-r--rw- (owner markos)
> 
> This way other users can run the reading_room.tcl program but can't  but 
> not edit.
> 
> And can't delete the files (.tcl or .db)
> 
> Trying to protect against Murphy, but not Machiavelli.
> 
> Thank you,
> Markos

I created a test setup similar to your solution:

2019-06-10 08:23:27 dpchrist@tinkywinky ~
$ cat /etc/debian_version ; uname -a
9.9
Linux tinkywinky 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u2 
(2019-05-13) x86_64 GNU/Linux

2019-06-10 08:14:52 dpchrist@tinkywinky ~
$ mkdir foo

2019-06-10 08:16:33 dpchrist@tinkywinky ~
$ chmod +t foo

2019-06-10 08:29:54 dpchrist@tinkywinky ~
$ echo 'echo "hello" >> /home/dpchrist/foo/hello.txt' > foo/hello.sh

2019-06-10 08:30:08 dpchrist@tinkywinky ~
$ chmod 0745 foo/hello.sh

2019-06-10 08:30:14 dpchrist@tinkywinky ~
$ echo 'initial contents' > foo/hello.txt

2019-06-10 08:30:40 dpchrist@tinkywinky ~
$ chmod 0646 foo/hello.txt

2019-06-10 08:30:53 dpchrist@tinkywinky ~
$ ls -l foo/hello.*
-rwxr--r-x 1 dpchrist dpchrist 45 Jun 10 08:30 foo/hello.sh
-rw-r--rw- 1 dpchrist dpchrist 17 Jun 10 08:30 foo/hello.txt

2019-06-10 08:31:29 dpchrist@tinkywinky ~
$ cat foo/hello.sh
echo "hello" >> /home/dpchrist/foo/hello.txt

2019-06-10 08:31:34 dpchrist@tinkywinky ~
$ cat foo/hello.txt
initial contents


If I test it as another user:

tinkywinky@tinkywinky:~$ ls -la /home/dpchrist/foo
total 8
drwxr-xr-t 1 dpchrist dpchrist   34 Jun 10 08:29 .
drwxr-xr-x 1 dpchrist dpchrist 1694 Jun 10 08:20 ..
-rwxr--r-x 1 dpchrist dpchrist   45 Jun 10 08:30 hello.sh
-rw-r--rw- 1 dpchrist dpchrist   23 Jun 10 08:39 hello.txt

tinkywinky@tinkywinky:~$ cat /home/dpchrist/foo/hello.sh
echo "hello" >> /home/dpchrist/foo/hello.txt

tinkywinky@tinkywinky:~$ cat /home/dpchrist/foo/hello.txt
initial contents

So, other users:

- Can see the script file system entry.

- Can see the data file file system entry.

- Can see the contents of the script (!).

- Can see the contents of the data file (!).


Continue testing:

tinkywinky@tinkywinky:~$ /bin/sh /home/dpchrist/foo/hello.sh

tinkywinky@tinkywinky:~$ cat /home/dpchrist/foo/hello.txt
initial contents
hello

So:

- Other users can run the script.

- The script can write to the data file.


Continue testing:

tinkywinky@tinkywinky:~$ rm -rf /home/dpchrist/foo
rm: cannot remove '/home/dpchrist/foo/hello.sh': Permission denied
rm: cannot remove '/home/dpchrist/foo/hello.txt': Permission denied

So, other users:

- Cannot delete the script.

- Cannot delete the data file.


Continue testing:

tinkywinky@tinkywinky:~$ echo "blah" > /home/dpchrist/foo/hello.sh
-bash: /home/dpchrist/foo/hello.sh: Permission denied

tinkywinky@tinkywinky:~$ echo "blah" > /home/dpchrist/foo/hello.txt

tinkywinky@tinkywinky:~$ cat /home/dpchrist/foo/hello.txt
blah

So, other users:

- Cannot overwrite the script.

- Can overwrite the data file (!).


Continue testing:

tinkywinky@tinkywinky:~$ vi /home/dpchrist/foo/hello.sh
echo "pwn3d" >> /home/dpchrist/foo/hello.txt
:w
E45: 'readonly' option is set (add ! to override)
:w!
"/home/dpchrist/foo/hello.sh" E212: Can't open file for writing
Press ENTER or type command to continue
:q!

tinkywinky@tinkywinky:~$ vi /home/dpchrist/foo/hello.txt
pwn3d
:w
"/home/dpchrist/foo/hello.txt" 1 line, 6 characters written
:q

So, other users:

- Cannot edit the script.

- Can edit the data file (!).


You have found an interesting combination of mode bits and multi-user 
behavior.  I can see how that could work in a "friendly" environment, 
where you are protecting against mistakes rather than protecting against 
attacks.


You will want to back up the data file frequently.


It has been many years since I played with the special mode bits.  This 
article is a decent refresher:

https://linuxconfig.org/how-to-use-special-permissions-the-setuid-setgid-and-sticky-bits


I found another article that describes how to wrap a script with a C 
program, so that the set UID and set GID bits will work.

https://engineering.purdue.edu/ECN/Support/KB/Docs/HowToSUIDSGIDscripts


If you created a restricted user account just for the app and data, 
created an executable wrapper, and adjusted the mode bits, I believe you 
could prevent users from seeing the contents of the script, seeing the 
contents of the database, overwriting the database, and editing the 
database.


David

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to set access permissions to protect a database file? Markos <markos@c2o.pro.br> - 2019-05-26 02:20 +0200
  Re: How to set access permissions to protect a database file? David Christensen <dpchrist@holgerdanske.com> - 2019-05-26 05:20 +0200
  Re: How to set access permissions to protect a database file? mick crane <mick.crane@gmail.com> - 2019-05-26 05:20 +0200
    Re: How to set access permissions to protect a database file? David Christensen <dpchrist@holgerdanske.com> - 2019-05-26 06:40 +0200
      Re: How to set access permissions to protect a database file? mick crane <mick.crane@gmail.com> - 2019-05-26 07:10 +0200
        Re: How to set access permissions to protect a database file? Markos <markos@c2o.pro.br> - 2019-06-10 00:00 +0200
          Re: How to set access permissions to protect a database file? mick crane <mick.crane@gmail.com> - 2019-06-10 00:40 +0200
          Re: How to set access permissions to protect a database file? Reco <recoverym4n@enotuniq.net> - 2019-06-10 08:00 +0200
            Re: How to set access permissions to protect a database file? john doe <johndoe65534@mail.com> - 2019-06-10 10:40 +0200
          Re: How to set access permissions to protect a database file? David Christensen <dpchrist@holgerdanske.com> - 2019-06-11 05:00 +0200
  Re: How to set access permissions to protect a database file? Joe <joe@jretrading.com> - 2019-05-26 10:20 +0200
    Re: How to set access permissions to protect a database file? Dan Ritter <dsr@randomstring.org> - 2019-06-10 01:10 +0200

csiph-web