World-writable files and SUID binaries
high on-server
What it inspects
Two searches over the root filesystem (`find / -xdev`, each limited to 20 seconds and 100 or 200 lines): regular files that anyone can write, outside /tmp, /var/tmp and /dev/shm; and SUID files not on a list of standard distro binaries. SUID files in rootless container storage are ignored. No findings passes, 1 to 5 warn, more than 5 fail. Timed-out searches are marked partial. A search that finds nothing counts as clean; the check is skipped only when both searches fail or time out without any output.
Why it matters
A world-writable file lets any local user, or any compromised service, change it, which is a common path to privilege escalation. A SUID program runs with its owner's rights, so each unexpected one is an extra place where a bug becomes root. Often these are harmless leftovers, but only a person can say which.
How to verify
sudo find / -xdev -type f -perm -2 ! -path '/tmp/*' ! -path '/var/tmp/*' ! -path '/dev/shm/*' ! -path '/proc/*' ! -path '/sys/*' 2>/dev/null | head -100
sudo find / -xdev -type f -perm -4000 ! -path '/proc/*' ! -path '/sys/*' 2>/dev/null | head -200
How to fix
Judgement step: look at each file, find which package owns it, then remove the world-write permission or the SUID bit only where you are sure it is not needed.
Review each finding before changing permissions needs your judgement
Any distro
# This check reports two kinds of finding. Review each one; do not change files you do not understand.
# 1) World-writable regular files outside /tmp, /var/tmp and /dev/shm (same filesystem only):
# find / -xdev -type f -perm -2 ! -path '/tmp/*' ! -path '/var/tmp/*' ! -path '/dev/shm/*' ! -path '/proc/*' ! -path '/sys/*' 2>/dev/null
# For each, find out who owns it and why: ls -l <path>; dpkg -S <path> (Debian) or rpm -qf <path> (RHEL family)
# If it should not be writable by everyone: chmod o-w <path>
# A file a package owns can be reset by the next update; on Debian, `dpkg-statoverride --update --add <owner> <group> <mode> <path>`
# keeps your change. On the RHEL family, re-apply it after updates.
# 2) SUID binaries that are not on the scanner's list of standard ones:
# find / -xdev -type f -perm -4000 ! -path '/proc/*' ! -path '/sys/*' 2>/dev/null
# Each SUID program runs as its owner (often root) for anyone who starts it. Check what owns it (dpkg -S / rpm -qf).
# If you did not intend it and nothing needs it, remove the bit: chmod u-s <path>
# If it is intentional (vendor tools, custom helpers), leave it: the finding then stays, by design.
# SUID files inside rootless-container storage are ignored by the check.
# Never strip SUID from sudo, su, passwd, mount and other standard tools: that breaks them.
# The check warns for 1-5 findings and fails above 5. Each search stops after 20 seconds on a large filesystem
# and then reports partial results, so scan again from a quiet host if the evidence says "partial".