Hector Martin

I’d have to check the man page, but I know for a fact that find can do that for you. I’ve done it for that very reason. That and to find world writable files.

Find as root cannot test for world readable/writable files. It can test the mode bits of the *files*, but cannot take into account parent *directories*. Mode 644 stuff inside a 750 directory is a common pattern. Easiest way to test is to just su to nobody and run plain find.

I feel like I have done exactly that. Or are you excluding world r/w files that can’t be gotten to? I.e. in a directory that is 0700? What about a hard link created in a different directory that is accessible? @ssrjazz do you have input here?

Yes creating a hard link to an inode may be tricky, but it’s not impossible.

Uh, no, that's impossible (without using root-only debug facilities). Doing so would be a massive security hole.

I’m fairly certain that it is possible to create a hard link to an inode even if you can’t access the directory that the other file linked to the inode is in. @ssrjazz what do you think? o+w on the inode in question and +w on the directory I’m creating the new link in.

Write the code, file the CVE, and get the sweet PoC karma then ;-)

Nope. I don’t know how to do it myself. Besides I believe that I’ve read about it multiple times in the past. So nothing new.