2

I'm writing an audit script to find all files with SUID & SGID bit set on the system, using the below command:

find / perm /u=s,g=s

The script will run with a non-root user. Will this user be able to (have permission) to search for all files with SUID/SGID bit set?

If not which specific permission would need to be granted to the user to accomplish this?

The Script would be run mainly on an RHEL system.

2

1 Answer 1

1

Well, to be sure, you'll need to run that script with escalated permissions.

Imagine that someone has an suid program inside the following directory:

$ ls -ld sneaky
d--x------. 2 user111 g1 4096 May 26 17:19 sneaky
$ ./sneaky/test.sh
runs

Your script will not be able to find that file, even if your program runs as user user111.

3
  • If the non-root user is granted sudo permission only for the 'find' command, will it work?
    – user116840
    Commented May 26, 2015 at 15:24
  • Yes/no. If the find command is looking for the permissions, yes. But once you have the filename, the non-escalated process won't be able to read or even list the file. But if you're OK with that, sudo the find.
    – Otheus
    Commented May 26, 2015 at 15:30
  • sudo find /etc -iname shadow -exec ..... You may want to restrict your sudo permissions a bit tighter than that. Commented Jun 12, 2015 at 5:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .