# su -s /bin/bash nobody And find out just how much stuff you've accidentally left world readable on your systems.
-
The hard link won’t show up if it’s created after the scan. The file is still insecure. Thus why I dislike world r/w without good reason.
You cannot create that hard link without access to the original file. The only way to access the original file is to have access via all the file path components, or to receive a directory fd from a process which does (at which point it's delegating permissions to you).
-
-
I believe it is possible to create a (hard) link to an inode without actually accessing any of the other links to it. Thus you can access the inode, thus file, independently of the path that it is in.
-
It is not. The closest thing is linkat(2), which requires an open file descriptor to a parent directory of the original link and access permissions to all subsequent path components. That can be used to bypass path restrictions only if another process with access delegates to you
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.