🚀 go-pugleaf

In <369069EB.BFDD8E76@adelaide.edu.au> Glen Turner <glen.turner@adelaide.edu.au> writes:

>  chmod o-r /etc/

>will cause problems with user applications.  A lot of default
>configurations are stored in /etc that are read by non-root
>programs as they start.

Removing read permission on the directory (while retaining search
permission) will enable files such as /etc/protocols to continue to
be read by ordinary users.

The only effect this operation will have is to prevent an ordinary user
doing "ls" on /etc. No part of the system needs to scan the contents of
/etc and any userland tools which use files in that directory open the
files by name (which requires directory search permission, not read).

In summary, this is a silly proposal, because:

 1. Most files in /etc have no security or privacy implications
 2. The names of most files in /etc are known anyway
 3. With search permission any wannabe can write a brute-force "ls"
 4. Userland tools need to read files in /etc so search permission is
    required regardless
 5. If your box is so god-damned important, don't give shell access to
    untrusted users.

Nick.
-- 
Zeta Internet                     SP4   Fax: +61-2-9233-6545 Voice: 9231-9400
G.P.O. Box 3400, Sydney NSW 1043        http://www.zeta.org.au/