Try it for yourself:
$ cd $HOME
$ mkdir -p denied/ok/
$ cd denied/ok/
$ echo hello > hello.txt
# lock down permissions of parent directory
$ chmod 000 $HOME/denied/
$ cat hello.txt
hello.txt
$ cat $HOME/denied/ok/hello.txt
cat: /home/iafisher/denied/ok/hello.txt: Permission denied
We can access hello.txt
with a relative path but not an absolute one.
$ cd ../..
cd: permission denied: ../..
$ cd $HOME
You can't cd ../..
because it traverses a forbidden directory. But you can cd $HOME
, even though it's the same absolute path.
Reason: For relative paths, Linux and macOS do not check permissions on the entire absolute path, only on the path components you've named (plus the implicit current directory).
Lesson: Even after tightening permissions, currently-running processes may continue to have access to the resource. ∎