Xref: utzoo comp.unix.aux:3729 comp.unix.admin:835
Path: utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!thunder.mcrcim.mcgill.edu!snorkelwacker.mit.edu!apple!usc!elroy.jpl.nasa.gov!swrinde!cs.utexas.edu!ut-emx!zebr360
From: zebr360@ut-emx.uucp (Jerry Heyman)
Newsgroups: comp.unix.aux,comp.unix.admin
Subject: Re: permissions in home directory
Message-ID: <42643@ut-emx.uucp>
Date: 17 Jan 91 03:05:56 GMT
References: <2669@dftsrv.gsfc.nasa.gov> <5716@rex.cs.tulane.edu>
Followup-To: comp.unix.aux
Organization: The University of Texas at Austin; Austin, Texas
Lines: 27

In article <5716@rex.cs.tulane.edu> dejesus@bourbon.ee.tulane.edu (Francisco X DeJesus) writes:
>
>    Ok, here's the situation: I'm trying to set up a guest account with
>a fixed .login and .cshrc. I thought of simply putting those two files the
>way I want them set up in the guest account's home directory, and have them
>owned by root, group root, and read-only (permission: -r--r--r--). The
>problem is that even with this setup the guest can delete them! What did
>I miss?
>

Some people would argue that this is a security flaw (and I have raised
this issue before), but in reality you are setting the protections on the
file (who can read it or write it).  Files inherit their deletion properties
from the directory that they reside in.

Because user guest has write (hence delete) permission in his own directory,
any files that are created in that directory can be deleted.

>--
>   ___ /      _______________________________      - Francisco X DeJesus

jerry heyman
-- 
Jerry Heyman                  by day: IBM AWD, AIX Development
zebr360@emx.utexas.edu        by nite: Adjunct Lecturer at St. Edward's Univ.

*All comments are my own and should not be construed to represent any one else