topic Security on machine and chgrp in Operating System - HP-UX

Security on machine and chgrp

Eric Pullen — Thu, 19 Apr 2001 12:55:33 GMT

Here is a test I have run as an "normal" user that seems to be a little troublesome:

touch test
chgrp root test

Should it allow me to change the group to root if this user is not part of that group?

Re: Security on machine and chgrp

Thierry Poels_1 — Thu, 19 Apr 2001 13:00:08 GMT

Hi,
if you create a file you have full control of that file. You can make it readable/writable/executable to whoever you want. You can change the group to each existing group.
You can even change the owner of the file, but then you loose control ;)

regards,
Thierry.

Re: Security on machine and chgrp

Marc Dijkstra — Thu, 19 Apr 2001 14:01:26 GMT

Your MAC - Mandatory access controls -- allow you, as the owner to change all permissions on the file except ownership. Your DAC -- discretionary access controls, are up to you...

for a safe(R!!) environment particularly WRT WWW, FTP etc, one should change the DAC attributes of a file. IE: for a file index.html, one could allow creation user the rights to change said file, however, for REAL security, give only the SU the right and group the R-X to the file, thus
----r-x--- root:www (create_date) index.html

Thus the DAC is sorted. For even safer HTML, leave as 040, rather than 050, but if the file is EXE then one will need the 050.
MND

Re: Security on machine and chgrp

Marc Dijkstra — Thu, 19 Apr 2001 14:09:21 GMT

Just reread what I wrote, and yep, big booger.... the owner CAN change the ownership of the file, and that, for security reasons WRT www, ftp etc. is a good idea...

My mantra:
MAC
DAC
authorisation... (hello Virtual vault)

Works a treat.
MND

Re: Security on machine and chgrp

Andrew Maslin — Fri, 20 Apr 2001 12:45:47 GMT

What Thierry said is correct. Remember that changing the group on a file does not grant the owner of the file, or anyone else who might read/write/execute the file, any additional privileges. If a user created a file, then changed permissions to 777, then changed the group to root and then the owner to root, the user would still have rwx to the file, but (assuming the file is executable) if they execute the file it will still run with their access privileges, so it won't be a security breach. Also, if the owner is changed, then the user won't be able to re-change the owner, group, permissions, etc. so they'll be stuck.

The thing you'd want to watch for is if you have executables somewhere run by superusers/system that had a user as the owner...