Bug 293490

Summary: A Way Around Root Permissions
Product: [I don't know] kde Reporter: pbea <2aq9j93b7s>
Component: generalAssignee: Unassigned bugs <unassigned-bugs-null>
Status: RESOLVED NOT A BUG    
Severity: normal CC: 2aq9j93b7s, cfeck
Priority: NOR    
Version First Reported In: 4.6   
Target Milestone: ---   
Platform: Debian testing   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:

Description pbea 2012-02-06 23:27:38 UTC
Version:           4.6 (using KDE 4.6.5) 
OS:                Linux

My apologies. I do not know who wants to claim ownership of this issue. Please distribute as you see fit. Thank You.

I downloaded Firefox10 and after declining Adobe I found ~/.adobe and ~/.macromedia folders in my user directory. I tried everything to try to prevent this from happening. I finally applied root forbidden permissions on the user folders. When I closed Firefox10 I found the root folders now had user permissions and files were populating the folders.

ps: I must have done something right because now Adobe gives me an internal error instead of the splash screen. Success in part.

I don't know how Adobe does it but I found a way to do it.

Reproducible: Always

Steps to Reproduce:
Apply root permissions to a user folder - as a user rename the folder (apparently this is allowed) - as a user recreate the original folder with user permissions.

i.e.
as root create a folder /.adobe with forbidden permissions
as a user rename the folder /.adobe.???
as a user create a folder /.adobe with normal permissions


Actual Results:  
The folder with root forbidden permissions has now changed to user permissions that allow entry.

Expected Results:  
A user should not be allowed to rename a root folder.

Hope this helps.
Comment 1 Christoph Feck 2012-02-07 00:28:42 UTC
KDE can do nothing about this. If you have write permissions in a directory, you are free to add/remove/rename files in that directory. The only way to prevent an application from creating crap in your home directory is to make the home directory read-only.

See also http://blog.hacker.dk/2010/05/users-can-deletemove-and-rename-files-owned-by-root-eg-via-an-ftp-server-why-and-how-to-fix-unlink_override-v10/