change /etc permission to --x--x--x

[yc_2]

Hi,

Is there any implication if I change the permission of /etc to 111 ?


Thanks in advance,
YC

[Trond Haugen]

There will only be search permission in /etc (not read).
ll /etc will fail with:
/etc unreadable.
In other words; don't do it.

Regards,
Trond

[Paula J Frazer-Campbell]

Yes

You have files in there that require read permission - passwd and hosts come immediatly to mind.

My suggestion is to leave the permissions alone and find another way to achieve what you whish to do.



What are you trying to achieve.??


Paula

[Ian Dennison_1]

Unfortunately you must be able to 'read' a file to execute it.

Share and Enjoy! Ian

[Peter Kloetgen]

Hi,

this is a very bad idea! No user will be able to login, if you do this recursively, because also the files /etc/passwd and /etc/group will be not readable during login process. And this is a requirement!!! The correct settings for /etc are 555, r-xr-xr-x.

Allways stay on the bright side of life!


Peter

[Steven Sim Kok Leong]

Hi,

If you change the directory permissions of /etc to 111 (executable only), the files will still be readable by a normal user, such as /etc/passwd etc. However you will not be able to list the contents of the /etc directory.

If there is a user program that requires a listing of /etc, it will fail.

Hope this helps. Regards.

Steven Sim Kok Leong

[harry d brown jr]

YC,

Can you explain why you would want to change the permissions to 111??

live free or die
harry

[Victor_5]

You must give "read" permission to files in /etc since there are a lot of configuration files over there.

[Bill Hassell]

As mentioned, changing /etc to 111 will be a DISASTER! Everything will immediately fail as there are dozens of critical configuration files that will no longer be accessible. Never try 'improve' the permissions on critical system directories such as /etc, /sbin, /dev, abd /usr as your system will break.

Everything in / must be 755 (drwxr-xr-x) except /tmp which can be 777 (drwxrwxrwx) or 1777 (drwxrwxrwt). 1777 means anyone can create files and directories but only the owner can remove them).

If you have files and/or directories in / that are 777, most likely umask has never been set so you need to spend a lot of time fixing all the wrong permissions on files and directories that were created after the first bootup (and add umask 022 or umask 077 to /etc/profile and /etc/csh.login immediately). To find files and directories with questionable permissions:

find / /opt /usr -xdev -perm -002 -exec /usr/bin/ll -d {} \;

Note: man page directories for user-formatted pages (ie, /usr/share/cat*) are OK, as well as unused tty/pty devices. However, *NO* disk devices (/dev/dsk/* and /dev/rdsk/*) should be writable (or readable!) by anyone except the owner, and similarly, all volume groups and logical volumes should only be read/writable by the owner. Otherwise, anyone can read (or write) anywhere on the disk, regardless of file/directory permissions.

[Christopher Caldwell]

Hmmmm. This change you're suggesting is probably not for the faint of heart.

Whether you should embark on this undertaking should probably be determined based on
1) your understanding of HP-UX and the side effects of not having a readable /etc directory
2) what your box does (it might not need a readable /etc).

That said, I'm assuming you mean change the permissions on the /etc directory from 755 or 555 to 111 (d--x--x--x). If that's the case, here's what you need to know:

r on a directory says read the contents of the directory (i.e. use ls).
w says change an entry in a directory (add remove files)
x says a directory may appear in a path name.

Thus, with the configuration

d--x--x--x 29 root bin 7168 Apr 8 09:57 /etc

and

$ ll /etc/passwd
-r--r--r-- 1 root sys 22940 Mar 28 08:45 /etc/passwd

The command more /etc/passwd will still work for the normal user (they can read the password file).

The change you're suggesting is fairly typical for chroot filesystems (like during the setup of anonymous ftp).

By changing the permissions on /etc, you're saying "I'll let you read it if you know it's there; I won't let you find it, if you don't know it's there."

$ ll /etc/passwd
-r--r--r-- 1 root sys 22940 Apr 8 09:57 /etc/passwd
$ ll -d /etc
d--x--x--x 2 root sys 96 Apr 8 09:57 /etc
$ ll /etc
/etc unreadable
total 0

This change "should" have little effect for the root user (since root doesn't pay much attention to file permissions).

# ll -d /etc
d--x--x--x 2 root sys 96 Apr 8 09:57 /etc

As Bill suggests, there may be other side effects (i.e. things that you don't think of that will break); these side effects depend on what you use the box for.

[Jeff Schussele]

Yes - the implication is that most things that need to read config files in /etc will break.

Not a good thing - DO NOT DO.

Rgds,
jeff