Linux File ACL and Permission Auditing: SUID, World-Writable, and Sensitive Files

Permission Security

File permissions control who can read, write, and execute files. Misconfigured permissions on sensitive files like /etc/shadow or SUID binaries can lead to privilege escalation.

Finding Dangerous Permissions

# World-writable files
find / -perm -o+w -type f 2>/dev/null

# SUID binaries
find / -perm -4000 -type f 2>/dev/null

# SGID binaries
find / -perm -2000 -type f 2>/dev/null

# Files without owner
find / -nouser -o -nogroup 2>/dev/null

Checking POSIX ACLs

getfacl /path/to/file
setfacl -m u:user:rwx /path/to/file
setfacl -R -m g:devs:rx /project/

Sensitive File Checks

ls -la /etc/shadow    # should be 640 root:shadow
ls -la /etc/passwd    # should be 644 root:root
ls -la /etc/sudoers   # should be 440 root:root

Automated Audit with dargslan-acl-check

pip install dargslan-acl-check
dargslan-acl-check