Hector Martin

# su -s /bin/bash nobody And find out just how much stuff you've accidentally left world readable on your systems.

I’d have to check the man page, but I know for a fact that find can do that for you. I’ve done it for that very reason. That and to find world writable files.

Find as root cannot test for world readable/writable files. It can test the mode bits of the *files*, but cannot take into account parent *directories*. Mode 644 stuff inside a 750 directory is a common pattern. Easiest way to test is to just su to nobody and run plain find.

I feel like I have done exactly that. Or are you excluding world r/w files that can’t be gotten to? I.e. in a directory that is 0700? What about a hard link created in a different directory that is accessible? @ssrjazz do you have input here?

World r/w files in a directory without world r/w permissions have to be excluded, of course. As I said, this is a common pattern. You can make your /home 700 and that immediately excludes everything under it from being a problem. Hard links will show up at their other location.

The hard link won’t show up if it’s created after the scan. The file is still insecure. Thus why I dislike world r/w without good reason.