4 ms·
on a unix server, you have to be root to read everyone's data. on an os x laptop, you can be the logged-in user and read everyone's data. file permissions don
by there 15y ago
on a unix server, you have to be root to read everyone's data.
on an os x laptop, you can be the logged-in user and read everyone's data. file permissions don't really mean much when everything of importance on the system is owned by one user (which is running dozens of applications with large attack surfaces).
that's not really a criticism of mac os, because it's the same on a windows desktop. you need elevated privileges on both systems to be able to do certain things to the system, but if all you want to do is steal sensitive documents, spy on the system's webcam, launch DDoS scripts, or add a command to the startup/login sequence, there's no need to bother elevating privileges.
one way to fix that problem is to make the system actually use the file permissions and user separation that the system already has, so that safari is running as a separate user with no access to the operating user's home directory, and that itunes has no access to the machine's webcam.
i haven't really looked into the sandbox feature of lion, but i'm assuming it does pretty much that, just like ios' concept of each 3rd party application being segregated from each other and not able to read files it's not supposed to.
- xsive 15y ago> on a unix server, you have to be root to read everyone's data. > on an os x laptop, you can be the logged-in user and read everyone's data Shenanigans. Unless you have the password of the logged in user, you can't read stuff belonging to other users. Further, if the user in question does not have an Admin account, you're shit out of luck even if you do know their password.
- tzs 15y ago> Shenanigans. Unless you have the password of the logged in user, you can't read stuff belonging to other users Their home directory defaults to world readable, and the default umask is set so documents created are world readable, so you can read things in their home directories. The Desktop, Documents, and so on directories are 700, so things in those should be unreadable.
- riffic 15y agoreboot into single user mode, be root, read anything. if you have physical access you can do anything
- jvdh 15y agoThis article is not about physical access, it's about remote security. If you have physical access to a machine, then you can almost always read the files off of it, except in certain cases with encrypted volumes.
- mveldthuis 15y agoI think his point was that on a laptop, everyone is often just the one logged in user.