0

I am trying to understand how giving 777 permission to folders or files works. I did some research and understand that 777 permission is not the best when it comes for security. Referring to Web application directories/files.

I do understand first sets of number which are the owners and groups, However I would like to clarify giving 7 permission to others. Who are the others, users within the server? Or anyone (even public users who access the website through the browsers)? And how others and what type of threat can others cause if the website folder/file had 777 permission?

And is there certain circumstances where it's ok to give 777 permission to folders/files, such as example of images, anything more out there?

Improve this question
1
  • here other users means , users available on servers ( which are not in the same group). If you give full permission recursively folders along with parent then any user can access your files and able to delete it.
    – Sunil Bhoi
    Dec 29, 2017 at 10:22

3 Answers 3

Reset to default
2

Who are the others, users within the server?

Others are non system users not accounted for by owner and/or group. Public users e.g. people browsing, access the files on the system via a process e.g. apache httpd. The process is owned by a user and access is granted to the files based on the permissions that are relevant to the users at the time of access.

And is there certain circumstances where it's ok to give 777 permission to folders/files, such as example of images, anything more out there?

On a properly configured system, very few if any files will need to be 777. The principal of least privilege should apply at all times. Why, for example, would you want to give execute permission on an image when it is not executable? Why would you give other write access to an executable?

Improve this answer
5
  • thanks for replying, can ask if you can help me to answer the this question which was mentioned earlier, And how others and what type of threat can others cause if the website folder/file had 777 permission?
    – CodeDoctor
    Dec 29, 2017 at 19:15
  • The threat is that if someone gains access then they have to gain less privilege to do damage. Simples.
    – user9517
    Dec 29, 2017 at 19:32
  • Can i ask what type of files considered executable and non-executable?
    – CodeDoctor
    Dec 29, 2017 at 19:44
  • 1
    @CodeDoctor Concentrating on a specific set of permissions (777) isn't very informative; you really should start with understanding how a server uses users, groups, and permissions to control internal access. If you understand that, you'll realize why 777 is almost never the correct set of permissions for anything. But looking at what's wrong with 777 won't tell you much about what you should use instead.
    – Gordon Davisson
    Dec 30, 2017 at 3:03
  • 1
    BTW, the reason 777 tends to have a bad rep isn't that there's something inherently wrong with it, it's because a reasonable analysis of what a file or directory's permissions should be almost never gives 777 as the best answer. 777 permissions are almost always a result of someone failing to understand how permissions work, getting frustrated, and just splattering permissions in hopes of getting something to function. Basically, 777 is a sign that someone's just given up on security.
    – Gordon Davisson
    Dec 30, 2017 at 3:10
1

Permission 777 certainly doesn't mean that

anyone (even public users who access the website through the browsers)

may alter your file.

It does mean that anyone on the system may do it - and this is potentially a lot of third parties. Let's say you have one hacked Wordpress website, just one among the many others, which runs on apache or designated system user - this site may be used to iterate system in order to find any accessible (readable, writable, executable) file - and guess who is on board?

So, stick to general recommendation to provide only minimum rights to the part of your system (whatever it may be) needed to work. 777 permission is rarely used besides non-private non-secret /tmp type of files.

Improve this answer
4
  • First of all thanks for replying, so as i understand that only system user can alter, edit the file. But what type of threat non-system users can cause if the directory had rwx permission for others? Can they insert malicious codes into the directory or file?
    – CodeDoctor
    Dec 29, 2017 at 11:11
  • What do you consider to be "non-system users"?
    – Miloš Đakonović
    Dec 29, 2017 at 12:01
  • Anyone who is browsing and visiting the website from browsers.
    – CodeDoctor
    Dec 29, 2017 at 19:02
  • by "browsing and visiting" not. But, by sending HTTP requests to hacked/vulnerable CMS(like Wordpress and others) in order to execute arbitrary commands, most certainly yes. So, pure "browsing and visiting" is far from enough. Someone would need additional entry point, like hacked PHP script to get in and execute commands.
    – Miloš Đakonović
    Dec 29, 2017 at 19:28
0

Consider any service account taking action on your files on behalf of a user, per se, including any system() calls within these files. To exploit 777 permissions, it becomes only necessary to compromise one account on a system.

This fact alone opens the door to any other category of potential danger you can encounter in a system. Is the code vulnerable to a buffer overflow and arbitrary execution? Is the program vulnerable to SUID/GUID exploits allowing privilege escalation? (I'm thinking KDE eFax here)

Proper permissions in place mitigate as much of these kinds of risks as possible.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .