Re: if file exist

[Robert A Duff <bobduff@shell01.TheWorld.com>]

Stefan Skoglund <stetson@ebox.tninet.se> writes:

> Mark Biggar wrote:
> > No, from a computer security point of view, this is exactly what is
> > wanted.  A user should see absolutely no difference between "file does
> > not exist" and "you don't have permission to see the file".  Otherwise,
> > you have introduced a covert information channel.
> 
> Hrmm, rather flimsy security in that case.
> Security-by-obscurity doesn't work.

Methinks you are misusing the term "security by obscurity", which I
understand to mean security by preventing people from knowing the method
of security.  For example, if you don't give out the source code for
your operating system, so people won't know the password encryption
algorithm, in an attempt to prevent people from breaking that algorithm.
You're right -- that doesn't work very well.  But it has nothing to do
with this case.

> In that case a simple 'ls filename' on unix
> will give a not enough permissions message
> 'ls `dirname filename`' will tell if we are having
> a directory permissions problem.

I'm not sure what the second command is attempting to do, but I'm pretty
sure that on Unix systems, if you have no access to directory "dir"
(i.e., rwx bits all zero), then you can't find out whether a given file
name exists in dir.  E.g., "ls dir/exists" and "ls dir/not-exists" will
both produce the same error message, even though exists exists and
not-exists does not.  Attempting to run a directory as a command will
cause an error, too, so I don't see how the second command causes a
security flaw.  Please explain the 'ls `dirname filename`'.

- Bob