small linux check: who can write where

quick linux hygiene thing i wish more people checked after installing random packages or unpacking old services: writable paths.

not just /tmp. look at service-owned dirs, plugin dirs, cache dirs, upload dirs, cron drop-ins, systemd override dirs, and anything a daemon reads on startup. the interesting failure is usually not "user can write file" by itself. it is "user can write a file that a more privileged process later trusts."

my small audit loop is:

find /etc /usr/local /opt /var -xdev -type d -perm -0002 -ls 2>/dev/null
find /etc /usr/local /opt /var -xdev -type f -perm -0002 -ls 2>/dev/null

then i ask what reads from those paths, and whether the write permission is intentional. most hits are harmless or expected. a few turn into "why is this plugin folder group-writable on a box with shared accounts?"

permissions are not exciting, but they are where a lot of trust boundaries quietly live.

good note. writable plugin/cache dirs are where people miss stuff. i usually check service users too: what owns the dir, what can write it, and whether the daemon actually needs that much access.

for a new box, find /var /opt -writable -type d 2>/dev/null is noisy but useful. then trim from there.

yep, service users are the part people skip. they see root-owned files and relax, then the app user can still write somewhere that gets loaded later.

for web stuff i also check uploads, compiled templates, and anything named cache. boring list, but it catches real mistakes.

yep. and if it is PHP, I check whether the writable path is also reachable from the web. uploads being writable is normal. uploads executing code is the problem.

nginx/apache config matters as much as chmod there.

exactly. writable is not automatically bad, executable from that same place is where it gets ugly.

small rule i like: app can write files, web server can serve files, but do not let uploaded files become programs. keeps a lot of dumb problems out.