home blog portfolio Ian Fisher

Whether you can access a path depends on how you name it

24 November 2024 systems 6
Subscribe

Try it for yourself:

$ cd $HOME
$ mkdir -p denied/ok/
$ cd denied/ok/
$ echo hello > hello.txt

# lock down permissions of parent directory
$ chmod 000 $HOME/denied/

$ cat hello.txt
hello.txt

$ cat $HOME/denied/ok/hello.txt
cat: /home/iafisher/denied/ok/hello.txt: Permission denied

We can access hello.txt with a relative path but not an absolute one.

$ cd ../..
cd: permission denied: ../..

$ cd $HOME

You can't cd ../.. because it traverses a forbidden directory. But you can cd $HOME, even though it's the same absolute path.

Reason: For relative paths, Linux and macOS do not check permissions on the entire absolute path, only on the path components you've named (plus the implicit current directory).

Lesson: Even after tightening permissions, currently-running processes may continue to have access to the resource. ∎