[solved] Execute permissions on directory

Well this is a bit embarrassing as well as confusing, but anyway here's the question.
I had always heard that the execute permission was required to cd into a directory, but recently someone demonstrated to me that it's possible to cd into the directory without execute permission.
I experimented a bit and found out that as a normal user, it's not able to enter a directory without execute permission, but as root it is possible to.
I searched around the internet but everywhere it's said that without execute bit it's impossible to do so.
So can someone explain what's going on?
Last edited by x33a (2014-01-23 05:52:49)

Awebb wrote:Would it makes sense to stop root from opening a directory, when owning the directory is only a chmod and/or chown away?
Well that should apply to attributes too, then. For example, setting the immutable bit with chattr, root cannot delete/edit the file, without doing a chattr -i on the file.
Barrucadu wrote:Root is basically exempt from the normal permissions system.
But I suppose that's the way it is then.

Similar Messages

Jar file - files with execute permissions (Unix)

I want to jar up a bunch of files. These files have execute permissions.
When I jar it up
jar -cvf myjar.jar <list of files>
Then I do
jar -xvf myjar.jar
It extracts the files, but the files loose the execute permissions.
How can I keep the same permissions? Is there an option in the jar command that will allow me to do that?

"execute" one of the .class files on a UNIX (or
similar) system, it wil basically tell you that you're
crazy.I am sorry but I have to intervent here, because that's plain wrong.
You can very easily set up your linux box to execute java progs from command line.
Look in your kernel's Documentation directory for a file called binfmt_misc.txt or read this:
(found via http://www.google.com/search?q=linux+kernel+execute+java)
http://www.linuxhq.com/java.html
I admit, that wouldn't be an extremely standard setup, but could explain why the OP wants to preserve executable privileges.
-T-

Why can't I grant execute on a directory?

Why can't I grant execute to a directory?
I have carried out the following:
Login as SYS
Prove that the oracle directory exists SELECT * FROM all_directories WHERE directory_name = 'dir_name';
GRANT EXECUTE ON DIRECTORY dir_name TO role_name;
The following documentation at the following address says that I can grant execute:
http://www.morganslibrary.org/reference/directories.html
And yet when I directed the dba to do it and when I query the database to see if He did it it shows me that he did:
GRANTOR                        GRANTEE                        TABLE_SCHEMA                   TABLE_NAME                     PRIVILEGE                                GRANTABLE HIERARCHY
SYSTEM                         role_name                    SYS                            dir_name                     EXECUTE                                  NO        NO
SYSTEM                         role_name                    SYS                            dir_name                     READ                                     NO        NO
SYSTEM                         role_name                    SYS                            dir_name                     WRITE                                    NO        NO
3 rows selectedWhen I try it in my xe environment it throws the error:
Error starting at line 1 in command:
GRANT EXECUTE ON DIRECTORY dir_name TO role_name
Error report:
SQL Error: ORA-22928: invalid privilege on directories
22928. 00000 - "invalid privilege on directories"
*Cause:    An attempt was made to grant or revoke an invalid privilege on a
           directory.
*Action:   Only CREATE, DELETE, READ and WRITE privileges can be granted or
           revoked on directories. Do not grant or revoke other privileges.What is going on?
Benton

Benton wrote:
Why can't I grant execute to a directory?Because you can't, according to the 10g documentation...
http://download.oracle.com/docs/cd/B19306_01/server.102/b14200/statements_9013.htm#BGEJEBCJ
However in 11g, it can be done...
http://download.oracle.com/docs/cd/E11882_01/server.112/e17118/statements_9013.htm#BGBCIIEG

Execute permissions problem

user created a stored procedure in one database and got "unable to execute stored procedure from database name blah blah", copied the stored procedure to another database and user could then execute it. User has exactly the same mapping in
both databases (i.e. db_datareader, db_datawriter, db_ddladmin) and is only in the server public role. why does he get the execute permissions problem on the firdt database? I have created a new user myself with the same mapping and get the same
problem.
IGNORE THIS>> I can see what the problem is now, the EXECUTE effective permission is missing from the first database - anybody know how to create an effective permission?
Update on the above following your much appreciated comments:-
1. The full error message (with any sensitive detail masked out) is:-
Msg 229, Level 14, State 5, Procedure xxxxxxxx, Line 1The EXECUTE permission was denied on the object 'xxxxxxxxx', database 'xxxxxxxxx', schema 'dbo'.
2. The problem is one database automatically gives execute permission when a login is mapped to it (even with just the db_datareader role selected) but the other doesn't. To see the permissions I refer to, right click database select
properties/permissions select the user and look at effective permissions, user has connect,execute and select (explicit permissions are connect only). The same login mapped to the other database has connect and select permissions only.
I haven't given any explicit permissions to the login mapped to the first or second database so why does the first have the explicit execute permission granted atomatically and the second not?
Even when I map the logins to the db_datawriter and db_ddladmin as well I still don't get effective execute permission on the second database. I know I can grant explicit permissions at schema or database level but do I don't have to do that
on the first database. There are no specific permissions on the schemas (i.e. db_datareader/writer/ddladmin or dbo) to public role or users

user created a stored procedure in one database and got "unable to execute stored procedure from database name blah blah",
It might be your opinion that error messages are only blah blah, and it is not worth time reading them. However, there is often useful information in error messages, and next time you have a question, please include any error message in full. Even if the
message is nonsense to you, it may not be to us.
I can see what the problem is now, the EXECUTE effective permission is missing from the first database - anybody know how to create an effective permission?
When you create a procedure in a schema, you don't become owner of the procedure, but the schema owner becomes owner of the procedure. And with no further rights, the creator can't execute. This can be resolved by granting the user EXECUTE permission
on schema level or database level:
GRANT EXECUTE ON SCHEMA::dbo TO developers -- schema-level
GRANT EXECUTE TO developers -- database-level
As the example hints, you should grant to a role rather than an individual.
Erland Sommarskog, SQL Server MVP, [email protected]

Cannot launch vivado simulator 2015.1: behav/compile.bat' script "Please check that the file has the correct 'read/write/execute' permissions"

Hi,
I'm trying to run a verilog simulation using the vivado simulator 2015.1 on Windows 7.
I get the following error when I attempt to launch simulation:
ERROR: [USF-XSim-62] 'compile' step failed with error(s) while executing 'D:/projects/axi/axi_test_system/axi_test_system.sim/sim_1/behav/compile.bat' script. Please check that the file has the correct 'read/write/execute' permissions and the Tcl console output for any other possible errors or warnings.
The tcl console repeats the same message, "Please check that the file has the correct 'read/write/execute' permissions"
I cannot find any problem with the permissions. I believe that windows will always execute a .bat file.   Within the same project, I can run elaboration, synthesis and implementation without problems.
Any idea why the simulation compile script won't run?
Thanks,
Ed

Hi,
Thanks very much for your detailed reply. These were the right questions based upon what I told you.
However, I took the code home last night and ran it on my webpack 2014.2 release.   It still failed, but I got completely different error messages.   These messages correctly pointed me to an undeclared signal in my testbench. Once fixed, the compile worked and the simulator launched.
This morning, I fixed the signal name in my 2015.1 setup, and it also compiled and launched correctly.
So, the problem wasn't actually related to file permissions. It seems like the 2015.1 error message may be broken compared to 2014.2.
I was running the Vivado GUI, clicking on "Simulate > Run Behavioral Simulation"
Thanks again for your help.
Regards,
Ed

[Windows] file.url throw error when application executable in root directory

Here is the bugbase ticked: Bug#3940278 - [Windows] file.url throw error when application executable in root directory
If you launch AIR application packaged as bundle from root directory and try to get url property of any file you get IllegalOperationError.
No matter what file url property you try to get.
It's a big problem when you distribute your application on CD disks or flash drive.
I'd like to ask everyone affected by this issue to take a minute and vote for the following bug.
Thanks.

I checked all deployment descriptions and there are no references to t3://localhost:7001. Few months back, I had the complete clustering setup working on 2 machines and now when I deploy my application on same configuration, it fails with t3://localhost:7001 unreachable error. I created a new cluster configuration on one machine with 2 managed server and it deploys fine. Can not figure out what has changed ?

Getting file read/write/execute permissions.

How can I get the read, write, and execute permissions for either a named file, or a File? I'm only interested in the permissions exposed to whatever user is running the VM.
System.getSecurityManager() either returns null or some default SecurityManager that denies everything... I guess you have to set that explicitly, which doesn't really help me here.
I've been browsing through the docs but I can't find anything that returns a FilePermission. It's highly possible that I missed something, though.
Thanks in advance,
Jason Cipriani
[email protected]
[email protected]

Thanks for replying.
That was the first thing I looked out. As it turns out, FilePermissions aren't for getting permissions on named files. Rather, they are for dealing out permissions that you set yourself, or representing permissions internally. If you look at the constructor for java.io.FilePermission, you'll see that, in addition to a file name (which, btw, can be anything since the constructor throws no IOException), you must also provide a list of permissions.
So, unfortunately, that class can't take a file name and provide you with a permission list... it's just there for you to use to store permission information.
That frustrates me a lot, because the name, FilePermissions, makes it seem like the most promising class to use for my application.
Thanks, though,
Jason.

Executable permissions removed from resource files

when DVD pro burns DVDs it removes the executable permissions from programs/installers that are stored on the DVD? (via DVD-ROM >> Content)
how can i keep the executable permissions? i currently zip the files but this is not an acceptable solution.
any ideas appreciated.

Sorry I have just noticed that after clicking OK and re-opening the Setup properties the DLL is not removed but the data subfolder where it is located gets relocated in Source Files -> Destination View to one folder level up
Is this a bug Labivew Projects->Build Specifications->Installer???

[SOLVED] Gnome: initial working directory set to / instead of HOME

Solved: See commentary #6
Hi there,
Since some weeks ago, don't know what I touched, everything starts from the root directory instead of starting from the home directory. That is, file managers, consoles, emacs, etc. start always in the root directory when searching for a file. I don't know why!
I have HOME properly adjusted and if I write "cd" in a console I go to home. Is there any other variable that controls the directory to start with?
Thanks
Last edited by jmcejuela (2009-07-05 11:17:13)

OK, I found the problem... quite stupid. I had all the commands that I typically use (I only use shortcuts, never the mouse) bound with gnome keybindings. Somehow the commands start with the working directory in /, and that was the problem.
Solutions for Gnome:
-Use another program for keybindings.
-A quite poor workaround. Create an executable to call your commands:
#!/bin/bash
cd && $1
and it will force the working directory to HOME
-Gnome working properly??
//thanks @anonymous for your support
Last edited by jmcejuela (2009-07-05 10:22:50)

Setting file execute permissions--a somewhat arcane question.

As I've been learning Unix, I'm often impressed by the logic and efficiency of certain features, so when I find things that don't fit this pattern, it really makes me wonder.
This particular example isn't so much about the design of permissions as it is about the way administrators--even competent ones--use them.
A case in point:
-rwxr-xr-x 1 root wheel 5099 Dec 7 2006 /usr/sbin/apachectl
This means that the file belongs to root, and root can do anything (s)he wants to it--read, write and execute.
Furthermore, anyone who belongs to the group, wheel (which, correct me if I'm wrong here, is pretty generally confined to root) can read and execute it. They can't write to it because, presumably, you don't want just any old wheel coming along and changing this file, although they may read it, which might be a good thing to do before they execute it.
Finally, other, that is, any old user, can execute the file, but they can't write to it, and they can't even read it. (Incidentally, why would you want to prevent someone from reading a file that you're allowing them to execute? Element of surprise? But that's not my real question.)
My real question involves the following: try logging on as anyone other than root and running that file. If Apache is running, try to stop it. It will tell you it isn't running. That's a lie. Okay, maybe an honest mistake, but it isn't true. Now try to start it. It doesn't have to be stopped; you'll get the same error either way: "fopen: Permission denied," it says, "httpd: could not open error log file /private/var/log/httpd/error_log."
I seem to run into this a lot. A file that I have permission to execute produces an error message when I try to run it because it tries to do something that I don't have permission to do. So why do I have permission to execute the file in the first place?
Okay, maybe there are some useful things I can do with apachectl, like configtest, that don't require me to be root. Like if I'm editing the httpd.conf file, I can check it with configtest, and then when it's ready I can go get an administrator to restart apache, or something like that. Except for the fact that I can't edit httpd.conf because I only have read access to that file. But maybe there are some imaginable scenarios where it might make sense.
But there are other files that you simply can't do a darned thing with, yet which still allow you to execute them and be chastised for your lowly permission status. Not only that, but it's a relatively simple matter to construct a script in such a way that it will check to see who is executing it, while it's processing directives, and return an appropriate error message, e.g. "Sorry, 'stop' and 'start' can only be performed by root," instead of allowing some downstream process to do its dirty work. Incidentally, allowing errors to be returned from downstream processes gives unprivileged users some insight into what the script does, which, presumably, is part of what they're trying to prevent by not allowing them to read the script!
If anyone can shed any light on why things are so often done this way, I'd appreciate it. If not, I guess this is just my Unix rant for the the week.
Disclaimer: I don't hate Unix. I really like it a lot, in spite of its quirks. No one is perfect; not even me! And don't even get me started on "Windows."

David Livesay wrote:
Perhaps you just don't know all the details of that particular application.
Please fill me in on the details I'm missing. That's why I posted this question.
I will try. But it is easier to explain why "programs in general" behave a certain way than why a "particular" program might behave a certain way. In particulars, I'm likely to be wrong. In generalities, I'll be more correct.
The default log location is in a directory that you cannot write to. However, this doesn't have to be the case. It could be anywhere.
Yes, and the permissions could be anything, but for the current location, the permissions don't make sense. You should always write a script for the situation that exists, assuming anyone who had a reason to move the log file would also have permission to change the file permissions accordingly. It doesn't make sense to set permissions according to what someone might do at some future time.
Sure it does. To use your apachectl example, Apache can be setup to put its log files anywhere on the system. It can be setup to use any particular user. It is one of the most configurable programs there is. It is "owned" by root so that it can't be messed with. It is "run" by nobody or www, so that, if it is compromised, it won't cause (much) damage. On Unix, there is no way to specify that a program is owned by one particular user and run by another particular user (well, maybe with ACL). For this program, the executable could be owned by www, but, since that user is configurable, that wouldn't make any sense. Plus, user ids are specific to each machine, only root is always uid 0. Plus, it is common practice for various reasons to start up as one user and either promote/demote to a different user. Plus, there are at least a dozen other process and daemon specific details that I'm ignoring. I'm trying to make it as short and sweet as possible.
There are only a few programs that only root should be able to run.
Please elaborate. Would this include apachectl in your view? If not, what reason would someone else have for running it when it is just going to fail? And remember, if you're going to say they can move the log file, I'm going to reassert that if they can do that then they can change the permissions accordingly.
I don't know the low-level details about apachectl in particular. Usually, any daemon or daemon related program can only be started by root, but is actually run as a different user. And while I say "only", that is not true. It is more correct to say "should". Everything is configurable! I might want to test out Apache 3.0, for example. I will have it configured to run as a regular user instead of root, because I am debugging it.
Usually, it is only very low-level, hardware programs (like fsck) that can only be run as root.
Many have world execute permission explicitly so anyone can run it. That anyone may be a user who have no privileges at all (such as nobody or www) so that if something it gets hacked, the script kiddie only gets access to nobody's files. Usually, that "anyone" is one of these specific users. That log file is probably owned by and is restricted to that user.
I don't quite follow you. If "anyone" can run it, that would include root. If someone is trying to hack a system, and can choose whether to run a script as root or an impotent user, why would they choose to run it as an impotent user? If they can only do damage by running a given executable as root, they're going to run it as root, whether or not anyone else has permission to run it.
You can't choose who to run a program as (unless you are root). A program is owned by whomever owns it. It is run by whomever is logged in. Apache, for example, runs "as" www. If hacked, all they can do is deface your web page, they can't bring down the server or compromise it in any other way. That is also why you shouln't even have root enabled on your system and why you should say in su or sudo mode for very long.

Solved: pacman - permissions differ on tmp/

Not sure if anyone else is seeing this because this may have been part of something I did a way back. I'm getting:
( 35/400) upgrading filesystem [######################] 100%
warning: directory permissions differ on tmp/
filesystem: 777 package: 1777
I know a bit about the filesystem package. If I remember correctly it contains files that are Arch specific like the boot scripts... Now if I'm reading this correctly the 777 permissions of "filesystem" is original directory and "package" is the package's permissions for the tmp directory. Here's my /tmp directory permissions after the update:
drwxrwxrwt 11 root root 4.0K Sep 13 11:41 tmp
Can anyone help me clarify this? Is the problem now fixed, or is there something I need to do?
Last edited by Gen2ly (2010-09-13 19:49:14)

I haven't seen pacman changing permission on directories yet, but according to the message, your /tmp didn't have the sticky bit set before the upgrade. Though things will work fine with just 777, not having the sticky bit on /tmp will mean that someone could delete and replace files owned by someone else, which is a security risk.

Execute Permissions denied on Schema

Hi ,
I've created a new schema in production database with some stored procedures and tables tied to it ,I need to grant permissions to execute, insert, select and delete permissions to me. I can access default dbo schema, I want ot knwo if below statements
can below statements grant me appropriate access to me or do I need any additional permissions.
GRANT EXECUTE ON SCHEMA::CCT TO dbo;
GRANT INSERT ON SCHEMA::CCT TO dbo;
GRANT SELECT ON SCHEMA::CCT TO dbo;
GRANT UPDATE ON SCHEMA::CCT TO dbo;
GRANT VIEW DEFINITION ON SCHEMA::CCT TO dbo;
I could not insert / update data within tables with schema for now.
Thanks,
Vishal.

You can give this permissions to DBO but are you the DB Owner? If not give the permissions to your user account or preferably a database role and add yourself as a member of the role.
If you are the DB Owner then you by default would have got these permissions.
Check this link to get better understanding -http://www.mssqltips.com/sqlservertip/2894/understanding-grant-deny-and-revoke-in-sql-server/
Regards, Ashwin Menon My Blog - http:\\sqllearnings.com

Xcode executable execution working directory on double-click

I have a fairly simple C++ code that I made with Xcode 3.1. It compiles fine and works if I run it from a terminal. But, if I double-click the executable, it launches and is looking for some supporting, local files at my "Macintosh HD" directory level instead of in the folder I launched it from (output files are also placed at that directory level). All file paths in the code are relative.
Is this a compilation issue or option that I can change in Xcode? How do I make it so I can also just double-click the executable?
Thanks,
John

Double clicking actually executes Terminal with root as current directory which then runs your C code. Change your code to look at the path in arg and use it to access the supporting files.

[SOLVED]New PHP documents directory

Hi
Now I have to save my files in /srv/http directory if I wanna display page. I would like change this directory to /home/rlk120/php/. Changed line
open_basedir=/srv/http/:/home/:/tmp/:/usr/share/pear/:/path/to/documentroot
didn't result.
Any ideas how to do it?
Last edited by xorgx3 (2012-06-02 13:26:31)

stryder wrote:BTW since /home is already in open_basedir you need not change that line.
Hmmm - OOTH I think that '/home/' means that it is not recursive. If you want to allow PHP to have acces to /home/ recursively (I would not recommend this), then you should use '/home' without the trailing slash.
As the above post suggests: edit the configfile for your virtualhost-app (or subfolder-app), move the files and double check the permissions.
Zl.

[solved] DBus permissions? polkit? a lot of things do not work.

Hello,
here is the problem.
i made some updates.
after rebooting i started to get problems.
I use KDE 4.9.3
first, NetworkManager was not working. i realize that there were some problems with permissions and NW.
in some way i was able to get it work and that's why i'm able to write here.
but: wireless is not working at all.
the error says: "no session found for uid 1000 (unknown)"
i cannot mount any kind of devices. the error says: "permission denided"
if i try to change the clock setting, kde is no more asking me the root password. indeed, the change has not effect. no error displayed
i really don't know where i could search for a solution.
is a DBUS problem? it seems so.
it's a problem of polkit? i found out that something happens in the last updates. i think that everything migrated to systemd and also there was something about polkit or policykit.
can some of you give me some suggestions?
do you have some ideas why i got this problems?
thanks in advance
Last edited by darkman (2012-11-22 22:09:36)

yes.
thanks.
that was the problem.
i followed the wiki and i found the solution. everything is solved.
thanks.
btw, i was thinking that everything was in auto-magic because
1) i'm a newbie here in arch
2) i found that the package was installed and, noticied that pacman configure the packages for you i convince myself that it did also for systemd.
3) i read the news but nothing was talking about the fact that "you have to follow the wiki". so, i was wrong.
thanks.

[solved] Execute permissions on directory

Similar Messages

Maybe you are looking for