File Permissions

Four lines from ls -l, the command that lists files with their permissions, run in the data folder of the league's Linux server:

-rw-r--rw-  1 regsite registrars 48213760 Feb  2 22:15 players.csv
-r--r-----  1 regsite registrars   912384 Feb  1 06:00 refunds_2025.csv
-rwxrwxrwx  1 regsite registrars    18032 Jan 28 17:40 export_roster
-r--r-----+ 1 regsite registrars   188411 Jan 30 09:12 draft_schedule.pdf

Each line ends with the file's name. Before it come the size in bytes and the date it last changed, and before those, two names: the file's owner, regsite, which is the account the registration program runs as, and the file's group, registrars, which holds the accounts of the registrar and an assistant. The string of letters and dashes at the start is the permissions.

Skip the first character, which marks the line as a file. The next nine come in three sets of three: what the owner may do, what members of the group may do, and what everyone else may do. Within each set the order is always read, write, execute, and a dash means that permission is absent.

The scheme is older than Linux. It comes from Unix, which Bell Labs programmers started in 1969 and soon ran on DEC PDP-11 computers like the one in the photo. Unix had the three sets, owner, group and others, by the mid-1970s. macOS keeps the same permissions today.

Read players.csv's string as three sets: owner, group, others. Who can change the players' records?

The registrars are the natural guess, since these are their records, but theirs is the one set that can't write. The string, rw-r--rw-, splits into rw- for regsite, r-- for registrars, and rw- for others: regsite can rewrite the records, and so can any account outside the registrars group. The last set is the mistake. Any such account, including one an adversary takes over through some other program, can read every child's record and rewrite it.

Signing in proves who an account is; these permissions decide what that account may then do to the file. Each set records a decision someone made.

The league's server administrator fixes players.csv first, with the symbolic form of chmod, the command that changes permissions. chmod o-rw players.csv takes read and write away from others and leaves the owner and group as they were.

The export program is next. It is the compiled program the registrar runs to print team rosters, and its rwxrwxrwx gives any account on the server the power to rewrite it, so the next roster run could do whatever an adversary put in it. The administrator uses the numeric form, chmod 710 export_roster. In that form each digit is one entity, and the digit is a sum: 4 for read, 2 for write, 1 for execute. So 7 is all three for the owner, 1 allows the registrars to run the program without reading or changing it, and 0 gives others nothing. The listing afterward:

-rw-r-----  1 regsite registrars 48213760 Feb  2 22:15 players.csv
-rwx--x---  1 regsite registrars    18032 Jan 28 17:40 export_roster

The refunds file needs nothing. Its r--r----- gives regsite and the registrars read access to the registrar's copy of last season's refunds and gives nobody write access, which suits the records of a season that has closed.

The draft schedule's line ends its permissions with +, which means the nine letters aren't the whole story.

The plus sign says more permissions are set on the file than the nine letters show, for particular accounts or groups. The command getfacl draft_schedule.pdf prints the rest, which here gives the field scheduler's account, outside the registrars group, permission to read the file.

Someone posted a 125-gigabyte download labeled part one on the message board 4chan on October 6, 2021. It held the source code of Twitch, the live-streaming service owned by Amazon, with its history of changes, along with internal security tools and reports of what Twitch had paid its streamers from August 2019 to October 2021. That night Twitch said the data had been "exposed to the internet due to an error in a Twitch server configuration change that was subsequently accessed by a malicious third party."

Twitch never said which setting changed, and nothing it published says the setting was a file permission. The next day it reset every streamer's stream key to be safe. Its update a week later said passwords, which it stored as hashes, were not exposed, and neither were full card numbers or bank information. What the case does show is how far one change can reach: a single configuration change put Twitch's source code and a share of its creators' payout data in front of a stranger. A chmod is a configuration change too, and the league's administrator listed the files again afterward to see what the commands had done.