Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to know how much damage a user can do on my system if he decides to delete everything (or write to in case of corruption).

What command or script might i use to check this?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted
target_user@host:~$ find / -writable
share|improve this answer
    
Excellent. It looks like most of the files here are special files (pipes) that can be written to but not corrupt or delete able. I cant tell which are folders but looking at the list the user appears to be 'safe' –  acidzombie24 Aug 18 '10 at 0:17
    
+1 well done, never have known! xD –  BloodPhilia Aug 18 '10 at 0:48
    
@acidzombie24 - if you want just directories, find / -writable -type d. If you want just files, find / -writable -type f. If you want files and dirs but not pipes and special files, find / -writable \( -type f -o -type d \). –  bstpierre Aug 18 '10 at 1:59
    
I just notice, it list a folder called /home/mybackup. doing stat i see 700 on it. So i am actually looking at a list of files/directories that are in writeable dirs? Is there a way to not include these folders? -edit- oh and i got a syntax error on ( so i wrote find / -writable -type f -o -type d maybe that is the cause of this incorrect behavior? –  acidzombie24 Aug 19 '10 at 1:25
    
The correct form of that command is probably find / -writable \( -type f -o -type d \), because bash interpretes unescaped parentheses by itself. –  whitequark Aug 19 '10 at 9:29
add comment

With that user, execute:

find / -perm -=w > ~/listoffiles.txt

writes a list of files to listoffiles.txt in your home dir.

share|improve this answer
    
Remember that apart from the file mode, there are UID and GID associated with the file. Moreover, you may have POSIX ACL's set. –  whitequark Aug 17 '10 at 23:54
    
@whitequark Still, this should work fine? –  BloodPhilia Aug 17 '10 at 23:58
1  
No. Imagine a (deletable) file with mode 0600: your test will miss it and mine won't (here's a log: pastebin.com/7jV0yTJ7) –  whitequark Aug 18 '10 at 0:27
    
@whitequark Haha! I hate it when you're right! Well done! –  BloodPhilia Aug 18 '10 at 0:47
    
just curious, was I right some times ago or is that an idiom I don't know? –  whitequark Aug 18 '10 at 1:08
add comment

You need to search for directories the user can write. Files don't have delete permissions. Try the command to find the easy directories. This should list /tmp and the uses home directory tree.

sudo -u your_user find -type d -writable -maxdepth 3 2>/dev/null 

This will miss any directories under directories the user can't scan into. However, they would also be missed by a wildcard delete. This list only goes three levels down which should get most of trees the user can write to. Change or drop the maxdepth to suit.

A more complete check would be any directories which meet one of these criteria:

  • Globally writable
  • Writeable by the user
  • Writable by any of the user's groups. (Always at least one group, possibly more).

The users will be able to delete files and directories below these directories. There are exceptions which will prevent deletion of everything below these directories. Being able to delete files in a directory, does not infer the directory may be deleted.

All bets are off if the user is root. However, there are permissions which can be set preventing even root from deleting a file.

share|improve this answer
    
Can't there be a directory owned by, e.g. root and mode 644 with a 666 file? The directory wouldn't be writeable for user, but file can be corrupted. –  whitequark Aug 18 '10 at 2:44
    
Yes that is true. The user is able to modify file based on the write privilege on the file. I only looked at the case of deletion which is most destructive. For file corruption us a find with '-type f' instead of '-type d' You could try something like this for everything writable: "sudo -u www-data find / -writable 2>/dev/null | egrep -v ^/proc | less" –  BillThor Aug 18 '10 at 20:13
    
Directory mode needs to include the 1 bit to be accessible. (Execute bit means enable file access on a directory.) Both my answers will miss the file under directories with execute enabled, but read disabled. For example root owned file and direcory wher directory mode is 511 and file permission is 666. To damage the file the user needs to know its there. This type of permission can be used for dropbox directories, where you don't want the dropper to be aware of what else has been dropped. This should be combined with the 't' bit to prevent users from deleting other users files. –  BillThor Aug 18 '10 at 20:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.