0

I am trying to understand how giving 777 permission to folders or files works. I did some research and understand that 777 permission is not the best when it comes for security. Referring to Web application directories/files.

I do understand first sets of number which are the owners and groups, However I would like to clarify giving 7 permission to others. Who are the others, users within the server? Or anyone (even public users who access the website through the browsers)? And how others and what type of threat can others cause if the website folder/file had 777 permission?

And is there certain circumstances where it's ok to give 777 permission to folders/files, such as example of images, anything more out there?

marked as duplicate by womble linux Jan 3 '18 at 6:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • here other users means , users available on servers ( which are not in the same group). If you give full permission recursively folders along with parent then any user can access your files and able to delete it. – Sunil Bhoi Dec 29 '17 at 10:22
2

Who are the others, users within the server?

Others are non system users not accounted for by owner and/or group. Public users e.g. people browsing, access the files on the system via a process e.g. apache httpd. The process is owned by a user and access is granted to the files based on the permissions that are relevant to the users at the time of access.

And is there certain circumstances where it's ok to give 777 permission to folders/files, such as example of images, anything more out there?

On a properly configured system, very few if any files will need to be 777. The principal of least privilege should apply at all times. Why, for example, would you want to give execute permission on an image when it is not executable? Why would you give other write access to an executable?

  • thanks for replying, can ask if you can help me to answer the this question which was mentioned earlier, And how others and what type of threat can others cause if the website folder/file had 777 permission? – CodeDoctor Dec 29 '17 at 19:15
  • The threat is that if someone gains access then they have to gain less privilege to do damage. Simples. – Iain Dec 29 '17 at 19:32
  • Can i ask what type of files considered executable and non-executable? – CodeDoctor Dec 29 '17 at 19:44
  • 1
    @CodeDoctor Concentrating on a specific set of permissions (777) isn't very informative; you really should start with understanding how a server uses users, groups, and permissions to control internal access. If you understand that, you'll realize why 777 is almost never the correct set of permissions for anything. But looking at what's wrong with 777 won't tell you much about what you should use instead. – Gordon Davisson Dec 30 '17 at 3:03
  • 1
    BTW, the reason 777 tends to have a bad rep isn't that there's something inherently wrong with it, it's because a reasonable analysis of what a file or directory's permissions should be almost never gives 777 as the best answer. 777 permissions are almost always a result of someone failing to understand how permissions work, getting frustrated, and just splattering permissions in hopes of getting something to function. Basically, 777 is a sign that someone's just given up on security. – Gordon Davisson Dec 30 '17 at 3:10
1

Permission 777 certainly doesn't mean that

anyone (even public users who access the website through the browsers)

may alter your file.

It does mean that anyone on the system may do it - and this is potentially a lot of third parties. Let's say you have one hacked Wordpress website, just one among the many others, which runs on apache or designated system user - this site may be used to iterate system in order to find any accessible (readable, writable, executable) file - and guess who is on board?

So, stick to general recommendation to provide only minimum rights to the part of your system (whatever it may be) needed to work. 777 permission is rarely used besides non-private non-secret /tmp type of files.

  • First of all thanks for replying, so as i understand that only system user can alter, edit the file. But what type of threat non-system users can cause if the directory had rwx permission for others? Can they insert malicious codes into the directory or file? – CodeDoctor Dec 29 '17 at 11:11
  • What do you consider to be "non-system users"? – Miloshio Dec 29 '17 at 12:01
  • Anyone who is browsing and visiting the website from browsers. – CodeDoctor Dec 29 '17 at 19:02
  • by "browsing and visiting" not. But, by sending HTTP requests to hacked/vulnerable CMS(like Wordpress and others) in order to execute arbitrary commands, most certainly yes. So, pure "browsing and visiting" is far from enough. Someone would need additional entry point, like hacked PHP script to get in and execute commands. – Miloshio Dec 29 '17 at 19:28
0

Consider any service account taking action on your files on behalf of a user, per se, including any system() calls within these files. To exploit 777 permissions, it becomes only necessary to compromise one account on a system.

This fact alone opens the door to any other category of potential danger you can encounter in a system. Is the code vulnerable to a buffer overflow and arbitrary execution? Is the program vulnerable to SUID/GUID exploits allowing privilege escalation? (I'm thinking KDE eFax here)

Proper permissions in place mitigate as much of these kinds of risks as possible.

Not the answer you're looking for? Browse other questions tagged or ask your own question.