I need to discover which are the permissions of a user in a CentOS system. Is it possible to find which are the directories the user can access and the command he can execute? It doesn't refer to ACL's.
To be able to execute a file, the file must
- Be owned by the user and be executable by the user, or
- Belong to the same group as the user and be executable by that group, or
- Be executable by "others".
find command find such files in the current directory (for the current user and their primary group only):
uid=$( id -u ) # the user's ID gid=$( id -g ) # the primary group ID find . -type f \( \ \( -user "$uid" -perm -0100 \) -o \ \( -group "$gid" -perm -0010 \) -o \ -perm -0001 \) -print
-0100 means "at least executable by user", and
-0001 are the equivalent for "group" and "others".
The same criteria holds or accessibility of folders (if I'm not entirely mistaken), so changing
-type f to
-type d should give you the accessible folders. One may additionally want to check the folders for the "read" bit too, obviously (
-0005 instead of the permissions above).
For folders, this may be a solution:
find . -type d \( \ \( -user "$uid" -perm -0500 \) -o \ \( -group "$gid" -perm -0050 \) -o \ -perm -0005 -o -prune \) -print
-prune at the end so that we don't descend into folders that the user wouldn't be able to access anyway.
Change the dot to a slash to search on the whole system.
It's also easy to turn it around to only print the names of e.g. folders that the user can't access:
find . -type d \( \ \( -user "$uid" -perm -0500 \) -o \ \( -group "$gid" -perm -0050 \) -o \ -perm -0005 -o -print -prune \)