how to grant a user to assess a directory under root ex... /tmp

[Grayh]

how to grant a user to assess a directory under root ex... /tmp

So that all the users can do a mkdir in it..

[Pete Randall · Accepted solution]

# ll -d /tmp
drwxrwxrwx 15 bin bin 8192 Nov 6 11:31 /tmp


Pete

[Grayh]

When I login as a user I have something like this ....

$ ll -d /tmp
drwxr-xr-x 4 root root 1024 Nov 6 10:26 /tmp
$

[James R. Ferguson]

Hi:

If the user can create a file then the user can create a directory. Directories confer the privilege.

Normal users should not create files or directories in '/tmp'. Rather, applications are intended to use '/var/tmp' for their temporary needs, reserving '/tmp' for root and operating system procecess.

That said, a good structure looks like:

# ls -ld /var
dr-xr-xr-x 26 bin bin 8192 Oct 29 2007 /var

# ls -ld /var/tmp
drwxrwxrwt 18 root sys 8192 Nov 6 12:27 /var/tmp

The absence of the (w)rite permission on '/var' prevents a non-root user from creating files or directories there, *but* allows those actions in '/var/tmp' (because of its (w)rite permissions.

Notice the use of the sticky-bit ('t') on '/var/tmp'. This prevents user "Able" from removing (deleting) a file owned by user "Baker". Directories confer write and delete permissions to files.

Regards!

...JRF...

[Patrick Wallek]

Those permissions for /tmp are incorrect.

The standard permissions for /tmp on HP-UX are:

rwxrwxrwt

To fix that do a:

chmod 1777 /tmp

[OldSchool]

ok....so Pete told you what the permissions need to be, and your permissions don't match.

Are you now asking how to fix them the way you want them? If so, i'd suggest:

man chmod

which would have answered your original question as well

[Grayh]

James,

Thanks for the wonderful explanation

I now understand the purpose of sticky bit and the directory permissions

Mine looks something like below

$ ll -d /tmp
drwxr-xr-x 4 root root 1024 Nov 6 10:26 /tmp

$ ls -ld /var
dr-xr-xr-x 23 bin bin 8192 Oct 3 13:40 /var

$ ls -ld /var/tmp
drwxrwxrwt 9 root root 8192 Nov 6 10:43 /var/tmp
$

To understand directories & their permissions and the use of sticky bit, creation & deletion .. could you give me a document or link where I can read and experiment on my test boxes...

[Pete Randall]

Hey Patrick!

I checked 7 different 11.11 boxes and they're all set that way, right out of the box, as it were. Are you looking at 11.23 or 11.31, by chance?


Pete

[James R. Ferguson]

Hi (again):

> To understand directories & their permissions and the use of sticky bit, creation & deletion .. could you give me a document or link where I can read and experiment on my test boxes...

Yes:

# man chmod
# man 2 chmod

+ portions of:

http://docs.hp.com/en/B2355-90950/B2355-90950.pdf

By the way, there are cases in applications where setting the sticky bit on a directory like '/var/tmp' will cause problems. This is where user-one creates a file with a non-unique name; doesn't delete it; and user-two comes along to try and create the same named file. He will fail! Caveat emptor.

Regards!

...JRF...

[Grayh]

Thanks everyone.... I was doing this on 11.23


gray ( learning unix bit by bit )

[Patrick Wallek]

@Pete:

Mine are all a combination of 10.20, 11.0 and 11.11 and are all rwxrwxrwt for /tmp.

Maybe we set ours that way manually after install. At this point I do not remember.

[Pete Randall]

Thanks, Patrick. I can see the logic for having the sticky bit set, in fact, I think I will do so. I just wondered if I was losing my mind (again) or not.


Pete

[Dennis Handly]

>Pete: I can see the logic for having the sticky bit set.

For security, the sticky bit should be set. I don't think 11.11 came with that.

The compilers now complain if TMPDIR doesn't have that bit set if Write Other is enabled. It will dump a big thesis in syslog.log.