ish-app / ish-app/ish

Non-root users can change modes for root-owned files and directories

Open
#2,197 3 comments 1 reaction 0 assignees View on GitHub
unconfirmed
Dominant language
C
Stars
20.5k
Forks
1.5k
PR merge metrics
No merged PRs in 30d

Description

For some reason, non-root users can change modes on files and directories owned by root (e.g. `/root`).
# Steps to reproduce
1. Open iSH
2. Check `ls -lahd /root`
3. Add a new user `nonroot`.
4. Do `su nonroot -c "chmod o+rx /root"`
5. Check `ls -lahd /root` again.
# Full test
```
ls -lahd /root
adduser -S -D -H nonroot
su nonroot -c "chmod o+rx /root"
ls -lahd /root
deluser nonroot
````

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by running the full test in iSH and tracing how chmod handles ownership and permission checks for /root. Done means a non-root user cannot change modes on root-owned files or directories, while the listed commands continue to behave correctly for permitted users.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.