Skip to content
stellvia.dev

Writable Paths Read by root

When a root service, a script run through sudo, or a timer reads a path writable by a low-privilege user, that path forms a privilege boundary. See File and Directory Permissions for discovery commands. If a timer invokes it, compare the path with the settings in Scheduled Execution.

Observation

Section titled “Observation”
Terminal window
find <APP_DIR> -maxdepth 5 -writable -ls 2>/dev/null
namei -l <APP_DIR>/<FILE>
stat <APP_DIR>/<FILE>

Hypothesis

Section titled “Hypothesis”
  • A root service, a script run through sudo, or a timer reads a file in a directory writable by a low-privilege user.
  • A symlink, .pth file, plugin, checkpoint, archive, log, or temporary file can serve as input.

Verification

Section titled “Verification”
Terminal window
grep -RniE 'open|read|glob|plugins|checkpoint|load|source|include|cat|cp|mv|chmod|chown' <APP_DIR>
findmnt -no TARGET,OPTIONS <MOUNTPOINT>
  • Purpose: Determine when the file is read, under whose privileges, and which API receives it.
  • Prerequisites: Testing write access changes state. Read stat, namei, and the code first.
  • Interpreting output: Each of glob("*.pt") with torch.load, site.addsitedir() with a group-writable directory, and cat after a symlink check can form a trust boundary.
  • Troubleshooting: Check whether earlier processing stops execution, mtime ordering differs, the mount uses nosuid or noexec, ACLs, and container versus host paths.
  • Alternative: Observe with inotifywait if available; otherwise, inspect timestamps and logs.
  • State changes: Record writes, symlink creation, and chmod as changes, then clean them up.

Placing a file alone does not establish a boundary. Trace whether a privileged process reads it and what the reading API does.

  • A root site.addsitedir() call processes a .pth file in a group-writable plugin directory at startup.
  • A symlink in a log directory may have multiple hops. The viewing process may check only the first hop.
  • A root training job reads a checkpoint on a shared mount. A chmod inside the container changes whether the host can write to it.
  • A root HTTP server saves converted output as a script in a public directory where it executes scripts.

Trust Boundaries in Custom Code diagrams the path to the reading API.