user owned groups

Chuck Swiger cswiger at mac.com
Wed May 11 12:15:48 PDT 2005


Lewis Thompson wrote:
> On Wed, May 11, 2005 at 02:33:30PM -0400, Chuck Swiger wrote:
>>setgid on directories won't help, but maybe the behavior of the sticky bit 
>>is what you are looking for?  Is how stuff in /tmp handled OK 
>>permission-wise for your expectations?
> 
> No, I was thinking more along the lines of inheriting permissions on new
> files from the directory they are in, i.e.
> 
> umask 22
> mkdir inherit && chmod 5700 inherit (let's pretend 5 is my inherit mode)
> cd inherit && touch test
> 
> The end result would be that test would be created 0600 (or maybe 0700
> but that's not very handy).
> 
> Does that make sense?  Is it possible?

Heh, good questions.  Yes, and it is probably not needed.

If "inherit" has 700 permissions, nobody who is not root or has the same UID 
can traverse down into inherit in order to look at or try to access test.

If you "mkdir private && chmod 700 private", any files created under private 
will be safely[1] hidden away from anyone else but you, regardless of their 
permissions or what your umask is.

-- 
-Chuck

[1]: Within the limits of the security of the filesystem, anyway.  If someone 
steals the hard drive, that's a different problem domain.  If you want to keep 
files truely secret, consider encryption, or avoid keeping them on a computer 
in the first place.



More information about the freebsd-questions mailing list