Bug 293490 - A Way Around Root Permissions
Summary: A Way Around Root Permissions
Status: RESOLVED NOT A BUG
Alias: None
Product: kde
Classification: I don't know
Component: general (other bugs)
Version First Reported In: 4.6
Platform: Debian testing Linux
: NOR normal
Target Milestone: ---
Assignee: Unassigned bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-02-06 23:27 UTC by pbea
Modified: 2012-02-07 00:28 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description pbea 2012-02-06 23:27:38 UTC
Version:           4.6 (using KDE 4.6.5) 
OS:                Linux

My apologies. I do not know who wants to claim ownership of this issue. Please distribute as you see fit. Thank You.

I downloaded Firefox10 and after declining Adobe I found ~/.adobe and ~/.macromedia folders in my user directory. I tried everything to try to prevent this from happening. I finally applied root forbidden permissions on the user folders. When I closed Firefox10 I found the root folders now had user permissions and files were populating the folders.

ps: I must have done something right because now Adobe gives me an internal error instead of the splash screen. Success in part.

I don't know how Adobe does it but I found a way to do it.

Reproducible: Always

Steps to Reproduce:
Apply root permissions to a user folder - as a user rename the folder (apparently this is allowed) - as a user recreate the original folder with user permissions.

i.e.
as root create a folder /.adobe with forbidden permissions
as a user rename the folder /.adobe.???
as a user create a folder /.adobe with normal permissions


Actual Results:  
The folder with root forbidden permissions has now changed to user permissions that allow entry.

Expected Results:  
A user should not be allowed to rename a root folder.

Hope this helps.
Comment 1 Christoph Feck 2012-02-07 00:28:42 UTC
KDE can do nothing about this. If you have write permissions in a directory, you are free to add/remove/rename files in that directory. The only way to prevent an application from creating crap in your home directory is to make the home directory read-only.

See also http://blog.hacker.dk/2010/05/users-can-deletemove-and-rename-files-owned-by-root-eg-via-an-ftp-server-why-and-how-to-fix-unlink_override-v10/