3

I need to ensure that, when deleting a specific user from a system, all of his/her files are removed. User creation/deletion will happen a lot on this system, so I want to reuse UID's and want to ensure the new user does not have access to any files of the old user.

My question is two-fold:

  1. Is there a general and easy way to find all files owned by a specific user? Or is a system-wide search -uid n my only option?
  2. If a system-wide search is the only option, then which directories are generally writeable by a normal user (suppose a distribution following FHS)?
    • His home directory
    • /tmp
    • ??

The user does not have sudo privileges, so he can only write in places that are world-writable in a standard Unix filesystem.

4

If you are removing an account, use userdel -r. This removes the user's home directory together with its contents. In addition the mail spool file belonging to the user is removed.

I wouldn't assume that any directory couldn't have held objects belonging to the user in question. This is particularly true if the user had SUDO privileges.

Use find to look for the UID of the account that you are going to delete; or have just deleted:

find / -user <UID> -exec ls -ld {} +

where UID is replaced by the actual UID value in question, or the username if you haven't already deleted the account;

or, in general for UIDs that no longer map to any name:

find / -nouser -exec ls -ld {} +

These are portable among various Unix flavors (HP-UX, AIX, etc.) and among Linux distributions. The GNU find allows the -exec ls -ld {} + to be replaced by -ls.

  • 1
    Note that find -user can take either a user name or a numeric user ID. See the man page. – a CVn Mar 20 '14 at 10:56
  • @MichaelKjörling Updated answer to reflect this. – JRFerguson Mar 20 '14 at 11:11
0

I did a bit of research of my own. Main source: http://www.tldp.org/LDP/Linux-Filesystem-Hierarchy/html/c23.html

Long story short: there is nothing that prohibits a user from creating files. However, in standard linux FHS, only some directories are writeable by everyone. As long as you use a distribution that follows this convention, you should only check the following directories (as shown by a test on my own system):

  • /dev/shm (mounted by default in some distributions)
  • User home directory
  • /var/tmp
  • /var/run/screen/S-rubenf
  • /tmp
  • /mnt/usb-disk (mounted with gid=users)

Source:

find -type d | 
  while read DIR; do 
    if touch $DIR/test_can_be_removed123 2>/dev/null; then 
      rm $DIR/test_can_be_removed123
      echo $DIR >> writable_directories
    fi
  done

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.