Unit 12: Auditing and hardening · Lesson 2 of 7 · 12 min
World-writable files
A file anyone can change is a file anyone controls.
mission
- You are
- You are sweeping for files everyone can write.
- Situation
- Shared folders like /tmp are writable by design. Scripts and configs never should be.
- Goal
- List every world-writable file and folder and sort normal from dangerous.
- Hand in
- The one file that must be fixed.
Good and bad
- Sticky folders/tmp, /var/tmp: normal
- Writable scriptsAnyone controls what runs
- Writable configsAnyone changes behaviour
Folders first
find / -xdev -type d -perm -0002 2>/dev/null
/tmp
/var/tmp
/run/lock
you should see All three carry the sticky bit, so people can only delete their own files. Normal.
find- Searches folders for files by name, type, owner, size or age. Built into Linux and macOS.
Then files
find / -xdev -type f -perm -0002 2>/dev/null /opt/scripts/rotate.sh stat -c '%a %A %n' /opt/scripts/rotate.sh 777 -rwxrwxrwx /opt/scripts/rotate.sh
you should see The script cron runs as root every hour. Your top finding.
stat- Shows a file's size, owner, permissions and timestamps. Built into Linux and macOS.
Fixes for the ticket
| Command | What it does |
|---|---|
chmod o-w file | Remove write for others |
chmod 755 script | Owner writes, everyone runs |
chmod u-s file | Remove SUID |
Files that belong to nobody
Files whose owner account was deleted can be claimed by a new account with the same UID.
find / -xdev -nouser 2>/dev/null | head -n 3 find /etc /opt /usr/local -perm -o+w ! -type l 2>/dev/null /opt/scripts/rotate.sh
you should see No orphaned files, and rotate.sh again in the narrower search.
head- Prints the first lines of a file or of piped text. Built into Linux and macOS.
What a defender takes away
- 1find -perm -0002 lists world-writable entries.
- 2Sticky folders are normal, writable scripts are not.
- 3Writable plus run by root is the worst combination.
Questions
0 of 1 solved
Answer each one from what you find on your lab machine.