Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve SUID find #168

Merged
merged 1 commit into from
Feb 14, 2022
Merged

Improve SUID find #168

merged 1 commit into from
Feb 14, 2022

Conversation

magmax
Copy link
Contributor

@magmax magmax commented Feb 12, 2022

I have this proposal to improve the SUID find.

To test it, I've created a structure with this script:

#!/bin/bash                                                                                            
                                                                                                       
for i in simple ignore1 ignore2 root; do                                                               
  mkdir -p $i                                                                                          
  for j in file1 file2 file_root file_2000 file_4000; do                                               
    touch $i/$j                                                                                        
  done                                                                                                 
done                                                                                                   
                                                                                                       
mkdir -p ignore1/root                                                                                  
mkdir -p ignore2/root                                                                                  
                                                                                                       
                                                                                                       
find . -name file_2000 -exec chmod 2000 {} \;                                                          
find . -name file_4000 -exec chmod 4000 {} \;                                                          
sudo find . -name "*root" -exec chown root:root {} \;                                                  
sudo find . -name "*root" -exec chmod o-rwx {} \;                                                      
                                                                                                       
tree -pu                                                                                               
                                                                                                       
echo "original:"                                                                                       
find . -perm -4000 -o -perm -2000 -type f ! -path './ignore1/*' ! -path './ignore2/*' -print           
                                                                                                       
echo "proposal:"                                                                                       
find . -type d \( -path "./ignore1" -o -path "./ignore2" \) -prune -type f -o -perm -2000 -o -perm 4000

As you can see, I modified the original find slightly to match my structure and to find in ., but it is essentially the same.

Running it looks like this:

image

There are some differences between my proposal and the original one:

  • my proposal found two files meanwhile the original just one.
  • my proposal successfully ignored completely the directories to be ignored, meanwhile the original entered on them and then ignored the files. So I decided to run the original one as it is, but avoiding to ignore the errors and ignoring /snap because it was faster:
    image

It seems to enter in the ignored directories and then ignore their content. My proposal just ignore them effectively, so it is much faster.

Note: I'm not sure if backslashes for parents should be duplicated when using the command in ruby.

@magmax magmax force-pushed the master branch 2 times, most recently from b9f6977 to 96df8e2 Compare February 12, 2022 16:35
Signed-off-by: Miguel Angel Garcia <[email protected]>
@micheelengronne
Copy link
Member

Thanks @magmax for the contribution.

@micheelengronne micheelengronne merged commit f1bff02 into dev-sec:master Feb 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants