On Sat, Feb 18, 2006 at 01:37:47PM +0200, Oleg Goldshmidt wrote: > Omer Zak <[EMAIL PROTECTED]> writes: > > > > However, when a directory is protected, then the files inside it are > > protected as well. > > Not quite true. > > For instance, I just did a quick check. While the actual profile > directory is 700, the upper level directories (e.g., > ~/.mozilla/firefox) are group-writeable. I have trivially replaced the > contents of the profile while logged in as a different user. You do > not want me to modify your bookmarks or history or cache, do you?
On my Debian Sarge: [EMAIL PROTECTED]:~$ ls -la ~/.mozilla/ total 9 drwx------ 3 tzafrir tzafrir 128 2005-11-26 16:24 . drwxr-xr-x 28 tzafrir tzafrir 1456 2006-02-18 15:19 .. -rw-r--r-- 1 tzafrir tzafrir 1045 2006-01-24 21:56 appreg drwx------ 3 tzafrir tzafrir 80 2005-11-26 16:24 default -rw------- 1 tzafrir tzafrir 532 2006-01-12 21:25 pluginreg.dat So .mozilla itself is not even group readable. So not even someone from my personal group can read any file there. Let alone modify it. Even a symlink to somewhere directly inside there would require execute permissions on directories along the path. So the defaults are safe. > > I did a crude job, and I did not cover my tracks too well, but I am > fairly sure that more sophisticated attacks are possible. There are > people more skilled in the Dark Arts than me on this list - they can > probably have a bit of fun. > > Is there a reason *not* to do > > chmod -R go-rwx ~/.mozilla Omer's point was that: chmod go-rwx ~/.mozilla (without the -R) should suffice. And is actually the case. -- Tzafrir Cohen | [EMAIL PROTECTED] | VIM is http://tzafrir.org.il | | a Mutt's [EMAIL PROTECTED] | | best ICQ# 16849755 | | friend ================================================================= To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
