لطفا منتظر باشید ...
Recipe 9.11 Finding Writable Files
9.11.1 Problem
You want to locate
world-writable
files and directories on your machine.
9.11.2 Solution
To find world-writable files:
$ find /dir -xdev -perm +o=w ! \( -type d -perm +o=t \) ! -type l -print
To disable world write access to a
file:
$ chmod o-w file
To find and
interactively fix world-writable files:
$ find /dir -xdev -perm +o=w ! \( -type d -perm +o=t \) ! -type l -ok chmod -v o-w {} \;To prevent newly created files from being
world-writable:
$ umask 002
Be aware of the important options and limitations of
find, so you don't inadvertently
overlook important files. [Recipe 9.8]
9.11.3 Discussion
Think your system is free of world-writable files? Check anyway: you
might be surprised. For example, files extracted from Windows Zip
archives are notorious for having insecure or screwed-up permissions.Our recipe skips directories that have the
sticky bit set (e.g.,
/tmp). Such directories are often
world-writable, but this is safe because of restrictions on removing
and renaming files. [Recipe 7.2]We also skip symbolic links, since their
permission bits are ignored (and are usually all set). Only the
permissions of the targets of symbolic links are relevant for access
control.The chmod command can disable world-write access.
Combine it with find -ok and you can interactively
detect and repair world-writable files.You can avoid creating world-writable files by setting a bit in your
umask. You also can set other bits for further
restrictions. [Recipe 7.1] Note that programs like
unzip are free to override the umask, however, so
you still need to check.
9.11.4 See Also
find(1), chmod(1). See your shell documentation for information on
umask: bash(1), tcsh(1), etc.
