Consider this scenario, pavel's actions are the same as in yours: pavel & guest: cd /tmp pavel: mkdir my_priv; cd my_priv pavel: echo this file should never be writable > unwritable_file guest: mkdir pirate_chest guest: ln my_priv/unwritable_file pirate_chest pavel: chmod 700 . pavel: chmod 666 unwritable_file pavel: cat unwritable_file guest: echo got you > pirate_chest/unwritable_file pavel: cat unwritable_file pavel might have detected this attack if he checked the number of hardlinks on "unwritable_file" between the chmod's. But he did not check that. Yes, procfs makes it possible to circument directory permissions but it does not mean you are not playing with an armed grenade whenever you mix chmod with the number of the Beast. -- Pavel Kankovsky aka Peak / Jeremiah 9:21 \ "For death is come up into our MS Windows(tm)..." \ 21st century edition /
