List all root owned files in non root folders

Question

I have to do an audit concerning the removal of root privileges for a server. To minimize the risk of something breaking or going the way of the dodo, i want to search for all root owned files/folders inside non root owned folders.

Is there a way to find and list the files such as:

> ls -la
drwxr-xr-x. 24 admin users     4096 Sep 27 12:53 .      [non root folder]
dr-xr-xr-x. 28 root root       4096 Mar 15  2017 ..
drwxrwxr-x.  2 admin users     4096 Sep 27 13:00 bin
drwxr-xr-x.  6 root  root      4096 Feb  9  2017 monit  [root file/folder]

as

/bin/opt/monit
...

Thank you.

Answer 1

1

find /starting/path -type d ! -user root -exec find {} -maxdepth 1 -user root \;

For every directory not owned by root a separate find is executed that lists direct children owned by root.

2

find /starting/path -user root -execdir sh -c 'test `stat -c %U ./` != root' \; -print

For every file owned by root a separate shell is executed that tests if the parent directory is not owned by root.

---

The two commands have different performance. The first creates a child process for every directory not owned by root. The second command creates two processes for every file owned by root. If you expect relatively few such directories and many such files, use (1). If you expect many such directories and few such files, use (2) maybe.

In general you usually have more files than directories so you should prefer (1).