2

I'm writing an audit script to find all files with SUID & SGID bit set on the system, using the below command:

find / perm /u=s,g=s

The script will run with a non-root user. Will this user be able to (have permission) to search for all files with SUID/SGID bit set?

If not which specific permission would need to be granted to the user to accomplish this?

The Script would be run mainly on an RHEL system.

1

Well, to be sure, you'll need to run that script with escalated permissions.

Imagine that someone has an suid program inside the following directory:

$ ls -ld sneaky
d--x------. 2 user111 g1 4096 May 26 17:19 sneaky
$ ./sneaky/test.sh
runs

Your script will not be able to find that file, even if your program runs as user user111.

  • If the non-root user is granted sudo permission only for the 'find' command, will it work? – user116840 May 26 '15 at 15:24
  • Yes/no. If the find command is looking for the permissions, yes. But once you have the filename, the non-escalated process won't be able to read or even list the file. But if you're OK with that, sudo the find. – Otheus May 26 '15 at 15:30
  • sudo find /etc -iname shadow -exec ..... You may want to restrict your sudo permissions a bit tighter than that. – Shadur Jun 12 '15 at 5:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.