S
Sherm Pendley
Shawn said:Not so, users in the same group cannot read, write or execute the files.
UNIX check only the user's permissions if you are the user, only the
group's permissions if you are in that group and only the other's
permissions if you are not the user or in the group.
That's not a safe assumption to make. My Debian Linux machine behaves as
you describe - if I disable group access for my group, but leave world
access enabled, I cannot read the file.
But My Mac OS X machine behaves differently. On that, access to a file
is granted if you have *any* means of doing so, whether it's by virtue
of owning the file, belonging to the correct group, or by way of the
"other user" permissions.
I don't know if what I'm seeing here is specific to Mac OS X, to HFS+,
or shared with any other BSD* variants. Although to me, it makes more
sense than what I'm seeing on Linux.
The traditional security mindset is to deny access by default (other),
and grant access only to specific users (group). This is what's enforced
on my Mac - if you want to deny anyone access to a file, you first have
to deny *everyone* access via other permissions, and then decide what
specific users to allow via group permissions.
Linux file permissions allow the opposite mindset as well - granting
access by default (other), while denying specific users (group). An
"allow by default" security mindset is not, in my opinion, a Good Thing.
sherm--