[ Solved ] A folder put behind root still opens with a user password

Luki · 2017-01-04 14:55:06

Hi!

So i made a root account and by my understanding made a folder only accessible by root by issuing chmod 400 for it. Yet still when trying to open it from the thunar context menu, it still opens with a user password.. So I need some help.

Last edited by Luki (2017-01-10 08:52:33)

nobody · 2017-01-04 15:03:41

1. Folders must have the executable bit set. That is, you want mode 700.
2. The folder must be owned by root:root.
3. All files below that folder must have correct modes and ownerships, too. A file with mode 644 in a directory with mode 700 is still world-readable, though the directory it is in is not.

So, assuming $PATH is the path to the folder in question,

sudo chown root:root -R "$PATH"
sudo find "$PATH" -type d -exec chmod 700 {} \+
sudo find "$PATH" -type f -exec chmod go-rwx {} \+

and root must create directories and files with a fitting umask, you'd probably want 0007.

Luki · 2017-01-04 15:16:04

twoion wrote:

3. All files below that folder must have correct modes and ownerships, too. A file with mode 644 in a directory with mode 700 is still world-readable, though the directory it is in is not.

What does this mean? The continents of the folder would be seen when using a program like a music player or image viewer by the user? Or can you give me an example?

Luki · 2017-01-04 15:49:25

For some reason I do not seem to be able to create a situation where the folder and its contents only open with a root password.. I followed the instructions and still they open with my regular user.

Head_on_a_Stick · 2017-01-04 19:36:47

Luki wrote:

by my understanding made a folder only accessible by root by issuing chmod 400 for it.

Yes, that is correct:

TheLab: ~ $ su -
TheLab: ~ # mkdir /test
TheLab: ~ # chmod 400 /test
TheLab: ~ # touch /test/test
TheLab: ~ # ls /test
test
TheLab: ~ # exit
TheLab: ~ $ ls /test
ls: cannot open directory /test: Permission denied
TheLab: ~ 2$

I have the same result with thunar...

So you must have done something wrong

Please list the *exact* commands that you used, both to set a root password and to apply the permissions to the folder in question.

Luki · 2017-01-05 13:43:01

Head_on_a_Stick wrote:

I have the same result with thunar...
So you must have done something wrong
Please list the *exact* commands that you used, both to set a root password and to apply the permissions to the folder in question.

I use the exact same commands with the exact same results BUT when I go to thunar and click "Open as a Root" and it prompts for the administrative password it opens with the user password, not with the root password. There is clearly something I do not understand here, may it have to do something with the settings in the sudoers file and/or the way I am logged in or something. If i have understood correctly, Bunsenlabs default settings are such that every user in the sudo group has access to root and therefore changing ownership and permissions to root do not permit users accessing files and folders with their sudo passwords. I dont know how to change things so that files owned by root can only be accessed with root password and not with a users sudo password.

damo · 2017-01-05 14:04:03

Surely "Open as Root" requires the user's sudo password, to open the file with root privileges? That is the expected behaviour for Thunar.

To run as the root user, wouldn't you have to log in as root?

tynman · 2017-01-05 14:47:39

I don't use Thunar, so maybe I should keep my yap shut. The confusion may simply be here:

it prompts for the administrative password it opens with the user password, not with the root password

... Assuming that "running Thunar open as root" really means to "run Thunar with sudo", then you would definitely need to supply your own password, not root's password. (Because the whole point of sudo is to allow a user (who has been authorized to use sudo) to temporarily gain some/all of root's privileges.)

PackRat · 2017-01-05 14:59:21

^ that's what I was thinking. Using sudo instead of su, gksu, or pkexec.

I don't use BL, but based on this -

Yet still when trying to open it from the thunar context menu, it still opens with a user password..

Is that a custom action in thunar for BL? I don't have any sort of "open as root" type context menu in thunar (Void linux Xfce desktop).

Last edited by PackRat (2017-01-05 22:43:03)

Luki · 2017-01-05 15:09:07

tynman wrote:

I don't use Thunar, so maybe I should keep my yap shut. The confusion may simply be here:
it prompts for the administrative password it opens with the user password, not with the root password
... Assuming that "running Thunar open as root" really means to "run Thunar with sudo", then you would definitely need to supply your own password, not root's password. (Because the whole point of sudo is to allow a user (who has been authorized to use sudo) to temporarily gain some/all of root's privileges.)

Given that things very likely are just as you described, how then will I achieve a situation where a user can pretty much do everything else but not access and view this one folder?

Luki · 2017-01-05 15:11:52

PackRat wrote:

^ that's what I was thinking. Using sudo instead of su or gksu.
Is that a custom action in thunar for BL? I don't have any sort of "open as root" type context menu in thunar (Void linux Xfce desktop).

Might be that I am mistaken, but "open as a root" comes with the xfce4-goodies package.

photonucleon · 2017-01-05 15:30:53

PackRat wrote:

Is that a custom action in thunar for BL? I don't have any sort of "open as root" type context menu in thunar (Void linux Xfce desktop).

It is a custom action, yes. I always presumed it was put there in Crunchbang/BL by corenominal/the dev team here.

damo · 2017-01-05 19:00:08

photonucleon wrote:

PackRat wrote:
Is that a custom action in thunar for BL? I don't have any sort of "open as root" type context menu in thunar (Void linux Xfce desktop).
It is a custom action, yes. I always presumed it was put there in Crunchbang/BL by corenominal/the dev team here.

It is included in the default "~/.config/Thunar/uca.xml" ( see "/usr/share/bunsen/skel/.config/Thunar/uca.xml" - installed Thunar context menu)

PackRat · 2017-01-05 23:44:33

@damo - thanks, copied it from the live session.

damo · 2017-01-05 23:48:18

PackRat wrote:

@damo - thanks, copied it from the live session.

Don't forget all the defaults are on github as well

PackRat · 2017-01-06 00:34:05

Luki wrote:

tynman wrote:
I don't use Thunar, so maybe I should keep my yap shut. The confusion may simply be here:
it prompts for the administrative password it opens with the user password, not with the root password
... Assuming that "running Thunar open as root" really means to "run Thunar with sudo", then you would definitely need to supply your own password, not root's password. (Because the whole point of sudo is to allow a user (who has been authorized to use sudo) to temporarily gain some/all of root's privileges.)

Given that things very likely are just as you described, how then will I achieve a situation where a user can pretty much do everything else but not access and view this one folder?

So you just want/need to restrict access to this one particular folder?

Or would you prefer that other users don't have sudo privleges at all? Note that the opening thunar with root privleges from the context menu is only one way to gain access to that folder.

Last edited by PackRat (2017-01-06 01:14:21)

Luki · 2017-01-06 08:58:36

PackRat wrote:

So you just want/need to restrict access to this one particular folder?

yes.

Head_on_a_Stick · 2017-01-06 19:38:34

Encrypt the folder contents, perhaps?

PackRat · 2017-01-06 20:30:04

^ Would that prevent users with sudo privleges from accessing the folder as well?

@Luki - I'm not sure if you'll be able to accmplish what you want to do as long as the other users have sudo privleges.

Horizon_Brave · 2017-01-06 22:43:17

Wait... I haven't looked at this since I took my linux+ exam years ago...but wouldn't the setting of the suid sticky bit accomplish what the OP wants?

SUID and Sticky Bits

SGID on a directory
– When SGID permission is set on a directory, files created in the directory belong to the group of which the directory is a member.
– For example if a user having write permission in the directory creates a file there, that file is a member of the same group as the directory and not the user’s group.
– This is very useful in creating shared directories.

Last edited by Horizon_Brave (2017-01-06 22:43:50)

#1 2017-01-04 14:55:06

[ Solved ] A folder put behind root still opens with a user password

#2 2017-01-04 15:03:41

Re: [ Solved ] A folder put behind root still opens with a user password

#3 2017-01-04 15:16:04

Re: [ Solved ] A folder put behind root still opens with a user password

#4 2017-01-04 15:49:25

Re: [ Solved ] A folder put behind root still opens with a user password

#5 2017-01-04 19:36:47

Re: [ Solved ] A folder put behind root still opens with a user password

#6 2017-01-05 13:43:01

Re: [ Solved ] A folder put behind root still opens with a user password

#7 2017-01-05 14:04:03

Re: [ Solved ] A folder put behind root still opens with a user password

#8 2017-01-05 14:47:39

Re: [ Solved ] A folder put behind root still opens with a user password

#9 2017-01-05 14:59:21

Re: [ Solved ] A folder put behind root still opens with a user password

#10 2017-01-05 15:09:07

Re: [ Solved ] A folder put behind root still opens with a user password

#11 2017-01-05 15:11:52

Re: [ Solved ] A folder put behind root still opens with a user password

#12 2017-01-05 15:30:53

Re: [ Solved ] A folder put behind root still opens with a user password

#13 2017-01-05 19:00:08

Re: [ Solved ] A folder put behind root still opens with a user password

#14 2017-01-05 23:44:33

Re: [ Solved ] A folder put behind root still opens with a user password

#15 2017-01-05 23:48:18

Re: [ Solved ] A folder put behind root still opens with a user password

#16 2017-01-06 00:34:05

Re: [ Solved ] A folder put behind root still opens with a user password

#17 2017-01-06 08:58:36

Re: [ Solved ] A folder put behind root still opens with a user password

#18 2017-01-06 19:38:34

Re: [ Solved ] A folder put behind root still opens with a user password

#19 2017-01-06 20:30:04

Re: [ Solved ] A folder put behind root still opens with a user password

#20 2017-01-06 22:43:17

Re: [ Solved ] A folder put behind root still opens with a user password

Board footer