1

I have to do an audit concerning the removal of root privileges for a server. To minimize the risk of something breaking or going the way of the dodo, i want to search for all root owned files/folders inside non root owned folders.

Is there a way to find and list the files such as:

> ls -la
drwxr-xr-x. 24 admin users     4096 Sep 27 12:53 .      [non root folder]
dr-xr-xr-x. 28 root root       4096 Mar 15  2017 ..
drwxrwxr-x.  2 admin users     4096 Sep 27 13:00 bin
drwxr-xr-x.  6 root  root      4096 Feb  9  2017 monit  [root file/folder]

as

/bin/opt/monit
...

Thank you.

1

1

find /starting/path -type d ! -user root -exec find {} -maxdepth 1 -user root \;

For every directory not owned by root a separate find is executed that lists direct children owned by root.

2

find /starting/path -user root -execdir sh -c 'test `stat -c %U ./` != root' \; -print

For every file owned by root a separate shell is executed that tests if the parent directory is not owned by root.


The two commands have different performance. The first creates a child process for every directory not owned by root. The second command creates two processes for every file owned by root. If you expect relatively few such directories and many such files, use (1). If you expect many such directories and few such files, use (2) maybe.

In general you usually have more files than directories so you should prefer (1).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.