Mastering Linux Security and Hardening - Second Edition

Finding spurious SUID or SGID files

One quick security trick is to run the find command to take inventory of the SUID and SGID files on your system. You can also save the output to a text file so that you can verify whether anything has been added since you ran the command. Your command will look something like this:

sudo find / -type f \( -perm -4000 -o -perm -2000 \) > suid_sgid_files.txt

Here's the breakdown:

• /: We're searching through the entire filesystem. Since some directories are only accessible to someone with root privileges, we need to use sudo.
• -type f: This means that we're searching for regular files, which includes executable program files and shell scripts.
• -perm 4000: We're searching for files with the 4000, or SUID, permission ...