Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to know if someone got access to my server by using a nonroot account, how much damage can he do?

After i su someuser I used this command to find all files and folders that are writeable.

find / -writable >> list.txt

Here is the result. Its most /dev/something and /proc/something and these


Is my system secure? /var/tmp makes sense but i am unsure why this user has write access to those folders. Should i change them?

stat /var/lib/php5 gives me 1733 which is odd. Why write access? why no read? is this some kind of weird use of a temp file?

share|improve this question

Users will require access to certain system level areas in order to run certain software. For instance the /var/run/mysqld/mysqld.sock has to be accessable for them to be able to interact with databases.

/var/run in general has run-time data such as unix sockets and pid files.

/var/lock contains lock files to allow software to prevent read/write collisions etc and to allow exclusive open of files (file locking etc).

The /var/lib/php5 has a very special file access mode - 1733 - the 1 at the beginning is important:

From man chmod

       1000    (the sticky bit).  See chmod(2) and sticky(8).

So, from man sticky we get:

     A directory whose `sticky bit' is set becomes an append-only directory,
     or, more accurately, a directory in which the deletion of files is
     restricted.  A file in a sticky directory may only be removed or renamed
     by a user if the user has write permission for the directory and the user
     is the owner of the file, the owner of the directory, or the super-user.
     This feature is usefully applied to directories such as /tmp which must
     be publicly writable but should deny users the license to arbitrarily
     delete or rename each others' files.

What that means is that it is a special security mode which allows a user to create or edit files in a directory, but only the owner of the file itself is able to delete it.

share|improve this answer
I think i'll accept this. When it allows me to – acidzombie24 Mar 8 '11 at 22:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .