Date: Wed, 16 Jun 1999 14:18:58 +0400 From: Alla Bezroutchko <alla@sovlink.ru> To: Barrett Richardson <barrett@phoenix.aye.net> Cc: freebsd-security@FreeBSD.ORG Subject: Re: reading files. Message-ID: <37677A12.D26816C3@sovlink.ru> References: <Pine.BSF.4.01.9906151314130.8046-100000@phoenix.aye.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Barrett Richardson wrote: > On Tue, 15 Jun 1999, Juergen Nickelsen wrote: > > David Shaw wrote on freebsd-security: > > > It's true that the NT Administrator can't read files that he doesn't > > > have permission for, but since Administrator controls the ACLs, if he > > > can't read something, he can trivially just change the permissions and > > > give himself access! > > He can't without taking over the ownership of the file, i. e. he can, > > but the original owner can tell afterwards. > Out of curiosity, can the owner's files be backed up via tape or some > other means? If so, couldn't an admin achieve the same access via an > API or some other mechanism? Yes they can. There is a system wide user right called "Back up files and directories". That means that user account that has been granted this right can circumvent permissions using some API call. Supposedly ntbackup uses this feature, but it looks like it is broken (I was unable to use it properly). -- Alla Bezroutchko Sovlink LLC Systems Administrator Moscow, Russia To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?37677A12.D26816C3>