Re: Security Issue

[Rick <rick@siservices.net>]

On Tue, 18 Mar 1997, Matthew Tebbens wrote:

> 
> I'm not sure if this is normal, but it seems that any file owned by
> someone else and in one of my directories can be deleted by me even
> if I don't have the proper permissions to do so. I also can rename the
> file, but I can't alter the file. This holds true even if the file
> is owned by root.
> 
> Is this normal ?

If this is true: 

"-rw-------   1 root     root           61 Mar 22 15:14 test.dat"

Then YES!!! a big problem.

> If so, what things can I do to someone elses file thats in one of my
> directories , just delete or rename the file ?

If you own the directory.

> As root, what if I want to keep a file in someones directory without them
> deleteing it ?  As I see it now, that can't be done ?!?!?

It can be overridden by the dir owner from what I can see.  There may be a
way to prevent it though.  I would think.

--Rick
rickya@siservices.net