1

Why can I execute programs without reading them?

$ echo 'echo "foo"' > test && chmod 100 test && ./test
foo
4
  • Suppose you are an admin and you have users whom you want to be able to run a script. If those users have permissions to also change the script somehow, it's a security hole. Same with reading - if users can see how it's implemented , they can try to find ways to bypass it Oct 26, 2015 at 21:08
  • But who is executing the script if the user is not able to read it?
    – Brettetete
    Oct 26, 2015 at 21:09
  • The shell. User gives commands to the shell. Oct 26, 2015 at 21:10
  • 2
    @Brettetete: I can reproduce this only as user root.
    – Cyrus
    Oct 26, 2015 at 21:18

2 Answers 2

4

I think your stated test command and case will only work under root (superuser), based on my tests with the exact same command on my Ubuntu Trusty box.

This is an unprivileged account:

[teward /home/teward/tmp/]% echo 'echo "foo"' > test && chmod 100 test && ./test
zsh: permission denied: ./test

This is as root:

[god /home/teward/tmp/]# echo 'echo "foo"' > test && chmod 100 test && ./test
foo

(Regarding god on my root prompt: I have root and my user using zsh as the login shell. My PS1 for ZSH replaces 'root' with 'god' for the root user on my system, but it's still 'root'. Privilege level is indicated by the character to the right of the closing square brace - the # indicates root, and % indicates standard user, which is how you know the privilege level)

I think this is because 'root' is considered god, and can do almost anything. Double-check the user you're using.

3
  • Oh that's awkward. I haven't even thought about trying this as non-root. Thanks for your answer.
    – Brettetete
    Oct 26, 2015 at 21:26
  • 2
    @Brettetete no offense but that's a very good indication that you probably shouldn't be running as root.
    – terdon
    Oct 26, 2015 at 22:38
  • @Brettetete I have to agree with terdon here - if you haven't thought about working with your computer as an unpriviliged, non-root user, then you should probably start doing this now...
    – Thomas Ward
    Oct 26, 2015 at 23:27
1

Because your shell has to read the file to know what to execute. If you remove read access, it can't read it so doesn't know what you want executed.

3
  • 1
    Not quite correct. You can have file without read-write permissions, but have permission to execute it. Oct 26, 2015 at 21:14
  • The shell has to be able to read the file to execute it. If you remove read permission for all users, the shell cannot read the file and therefore cannot execute it. Try it! Oct 26, 2015 at 21:18
  • 1
    @Serg That only holds true to the root account as permissions don't matter to it. As a normal user, it cannot be read, so executing a file as a normal user it should say permission denied.
    – Terrance
    Oct 26, 2015 at 21:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .