Possible security hole?

[SC68Cal]

I might have found at least, an itsy bitsy hole.

Normally a user without administrator privs. cannot add items to the /Applications directory without the authenticating with an Admin account. However, in terminal, someone can invoke rm <folder> into /applications without having to authenticate.

 

[glib]

I can also rm -R something in /Applications with my normal user account. However, I can also copy to applications with my normal user account just fine. Permissions are the same for me.

 

[SC68Cal]

Meaning you don't need to authenticate to add programs to /Applications via Finder as a standard user?

 

[beatsme]

I might have found at least, an itsy bitsy hole.

Normally a user without administrator privs. cannot add items to the /Applications directory without the authenticating with an Admin account. However, in terminal, someone can invoke rm <folder> into /applications without having to authenticate.

report it to Apple. See what they say.

 

[bearbo]

i think it depend on what your privilage is... im not sure

also, i think u can add small simple drag into app folder apps... if not to the root app folder, at least to user app folder...

 

[MacBoobsPro]

If you think you have found something iffy. Dont post it on a forum, keep it quiet and tell Apple.

 

[scottlinux]

This is not a security hole. These are standard permissions in OS X.

 

[SC68Cal]

Okay. I've tried to replicate what I did last night with just a normal folder. I was given a permission denied error.

I'm going to retrace what exactly allowed me to move the program "John The Ripper" into the Applications folder from my Standard Account.

Currently, the permissions for the John folder

Owner = Standard Account
Access = R & W

Group = Admin
Access = R & W

Others = No Access

I'm beginning to wonder if that since I compiled John with my admin account, that is what allowed it to be moved.

 

[ddekker]

ROFLOL... I love the "its not a hole.. its a feature"... lol.. if it were MS it would be all over the news...

D

 

[gauchogolfer]

ROFLOL... I love the "its not a hole.. its a feature"... lol.. if it were MS it would be all over the news...

D

Who the heck has made this comment? Honestly.

The OP even reported that he has some admin privileges on the account, and the other posters suggested reporting it to Apple.

Sheesh