user owned groups
Chuck Swiger
cswiger at mac.com
Wed May 11 12:15:48 PDT 2005
Lewis Thompson wrote:
> On Wed, May 11, 2005 at 02:33:30PM -0400, Chuck Swiger wrote:
>>setgid on directories won't help, but maybe the behavior of the sticky bit
>>is what you are looking for? Is how stuff in /tmp handled OK
>>permission-wise for your expectations?
>
> No, I was thinking more along the lines of inheriting permissions on new
> files from the directory they are in, i.e.
>
> umask 22
> mkdir inherit && chmod 5700 inherit (let's pretend 5 is my inherit mode)
> cd inherit && touch test
>
> The end result would be that test would be created 0600 (or maybe 0700
> but that's not very handy).
>
> Does that make sense? Is it possible?
Heh, good questions. Yes, and it is probably not needed.
If "inherit" has 700 permissions, nobody who is not root or has the same UID
can traverse down into inherit in order to look at or try to access test.
If you "mkdir private && chmod 700 private", any files created under private
will be safely[1] hidden away from anyone else but you, regardless of their
permissions or what your umask is.
--
-Chuck
[1]: Within the limits of the security of the filesystem, anyway. If someone
steals the hard drive, that's a different problem domain. If you want to keep
files truely secret, consider encryption, or avoid keeping them on a computer
in the first place.
More information about the freebsd-questions
mailing list