Omer Zak <[EMAIL PROTECTED]> writes:

> However, when a directory is protected, then the files inside it are
> protected as well.  

Not quite true.

For instance, I just did a quick check. While the actual profile
directory is 700, the upper level directories (e.g.,
~/.mozilla/firefox) are group-writeable. I have trivially replaced the
contents of the profile while logged in as a different user. You do
not want me to modify your bookmarks or history or cache, do you?

I did a crude job, and I did not cover my tracks too well, but I am
fairly sure that more sophisticated attacks are possible. There are
people more skilled in the Dark Arts than me on this list - they can
probably have a bit of fun.

Is there a reason *not* to do 

chmod -R go-rwx ~/.mozilla

??

-- 
Oleg Goldshmidt | [EMAIL PROTECTED] | http://www.goldshmidt.org

=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]

Reply via email to