Do hackers know more than you about file system security? Unix access control (security@cambridge)

Описание: The second lecture of my official security course at the University of Cambridge.

00:00 Three microchallenges
00:45 Introduction
03:11 Supervisor mode
05:31 Mandatory vs Discretionary access control
06:22 Access control matrix
07:20 Users, groups, files, directories, inodes
09:22 Permission bits
11:16 Chmod: change mode bits (permissions)
12:56 Permission check algorithm
14:00 Chown: change owner and group
14:49 Su: substitute user
15:43 Principle of least privilege
17:03 The setuid and setgid bits
19:35 Real, effective and saved user ID
20:52 Privilege escalation by social engineering and setuid
23:25 Umask
24:25 The sticky bit
26:21 Conclusions (and hints)

Course web page:
https://www.cl.cam.ac.uk/teaching/212...

Course textbook and exercises:
https://www.handsonsecurity.net
https://seedsecuritylabs.org

Virtualbox (required for the SEED labs):
https://www.virtualbox.org

Capture-the-flag security competitions I co-founded:
   • CTFs I co-founded  

My home page:
http://stajano.com