How to audit file permissions on Linux with find

Why open permissions on Linux pose a real danger

In the Linux operating system, every file and directory has strict access rules that define who can read, modify, or execute the content. In practice, these rules protect confidential data against unauthorized access by other users or malicious processes running on the same machine. When human error or a misconfigured script alters these permissions to an overly permissive format, critical doors are left wide open for any standard system account.

The most severe risk occurs with world-writable files, a scenario where anyone with server access can modify vital configuration files or system scripts. To prevent silent intrusions, administrators must perform constant audits, a task made easier by monitoring system health via the terminal. Locating these breaches before an attacker exploits them is the difference between maintaining a secure environment and suffering a complete compromise.

How to identify files with world-writable permissions

The find utility is the most powerful tool in the Linux ecosystem for scouring entire directory trees based on complex search criteria. To hunt down files that can be modified by any user, we use specific parameters that analyze permission bits in octal or symbolic format. In practice, the write bit for others is the main target of our investigation.

Run the command below in the terminal to list all regular files within the current directory that have the write permission enabled for any system user:

find . -type f -perm -002

In this command, the dot (.) indicates the current directory, -type f filters only regular files, and the -perm -002 modifier searches for permissions where the world-writable bit is active, ensuring a surgical sweep. If you prefer to scan the entire disk for critical flaws, simply replace the dot with the root slash (/). Additionally, to mitigate attack vectors on exposed servers, it is essential to follow good practices like configuring firewall rules with UFW to limit unwanted external traffic.

How to isolate dangerous directories in your search

Files are not the only targets that can compromise the security of a Linux server; directories with incorrect permissions pose an even greater danger. If a directory has world-writable permissions, any standard user can delete or replace other people's files inside it, even if the files themselves are protected. Therefore, refining the search to separate files from folders is a mandatory step in any professional security audit.

To specifically search for vulnerable directories where the danger of improper deletion is high, we use the corresponding directory type argument in the scan command. Type the following command in the terminal to list these suspicious folders:

find /var/www -type d -perm -002

Here, the -type d parameter restricts the search strictly to directories located within the specified path, avoiding false positives with regular files. If you encounter performance anomalies or strange disk behavior during these scans, it can be helpful to diagnose NVMe slow performance via terminal to ensure the hardware is not failing.

How to automate fixes with the exec operator

Merely locating vulnerable files does not solve the security problem if an administrator has to change each permission manually, one by one. Fortunately, the find command has a native mechanism called -exec that allows you to execute corrective actions directly on each result found by the scan. This transforms a repetitive, exhausting task into a single safe and fast line of code.

To immediately remove world-writable permissions from all files found in the current directory, run the command below combining the search with attribute modification:

find . -type f -perm -002 -exec chmod o-w {} +

In this advanced instruction, chmod o-w removes the write permission specifically for the others category, preserving the rules meant for the file owner and their group. The curly braces {} dynamically represent each file found by the search, while the plus sign (+) groups files so the operating system processes them in batches with maximum efficiency.

Final Considerations

Maintaining the integrity of a Linux-based operating system requires constant vigilance against careless configurations that open unnecessary security gaps. Using the find command combined with permission filters and automated actions ensures administrators can scan large volumes of data in seconds. Combining this auditing routine with other network and hardware protection layers solidifies the resilience and reliability of any modern infrastructure.

Adopting the habit of running periodic checks prevents dangerous permissions from slipping through unnoticed after software updates or sloppy installations. With the practical knowledge gained in this article, you have robust tools to identify silent flaws and harden your servers against unauthorized access.