Prove effective file, directory, ACL and mount control

Needs: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Shell commands

# Baseline
namei -l /PATH/TO/OBJECT
stat /PATH/TO/OBJECT /PATH/TO/PARENT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT 2>/dev/null
findmnt -T /PATH/TO/OBJECT -o TARGET,SOURCE,FSTYPE,OPTIONS

# Baseline
find / -xdev -type f -writable -ls 2>/dev/null
find / -xdev -type d -writable -ls 2>/dev/null

Verify → Prove the specific read/write/replace action and consumer path; world-writable alone is not the complete escalation chain.

If it fails → A read-only/noexec/nosuid mount changes which effects are possible. Find another consumer rather than assuming every permission bypasses mount policy. More detail ↓

If → then

Root-owned cron, systemd or recurring process activity uses a controllable object → Control a script, binary or configuration consumed by a privileged job/service
Needs: Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger
A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path → Control a privileged program's shared-library resolution
Needs: Actual privileged load from a controlled location, matching ABI/name and required symbols, plus a trigger
Account metadata or a privilege-policy file appears writable → Change a writable account or privilege-policy file
Needs: Effective write/replace permission, known file syntax and a useful identity/policy consumer; preserve the original

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Prove effective file, directory, ACL and mount control

USE WHEN: A root-consumed file or directory appears writable
STARTING ACCESS: A verified Linux foothold with a known effective UID, groups and filesystem context
RESULT: A validated controlled object suitable for a specific execution or credential chain

Recognize the clue

From a real privileged script/binary/configuration path inspect every parent, ACL and effective mount before assuming control.

namei -l /PATH/TO/OBJECT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT
findmnt -T /PATH/TO/OBJECT

SYNTHETIC EXAMPLE OUTPUT

file: root-owned, not directly writable
parent: current group has write+execute
mount: rw

Means: Parent replacement can provide a control primitive even when the existing file's write bit is absent.

Confirm: Run namei -l, stat and getfacl on the exact path and its parents, then findmnt -T for ro/noexec/nosuid. Check the identity and trigger of the process that uses this path; write permission alone is not execution.

After validation: The precise object can be replaced and is consumed under a higher identity: choose that control path.
Ruled out in this context: Parent/file rights do not grant the needed operation: reject that proposed write.
Still inconclusive: An ACL listing without effective trustee/mount context leaves control unresolved.

Troubleshooting: A read-only/noexec/nosuid mount changes which effects are possible. Find another consumer rather than assuming every permission bypasses mount policy.

Directory write+execute can permit replacement even when the file is not writable. ACLs can add/remove effective access. nosuid defeats SUID/SGID and file-capability effects; noexec blocks direct execution; ro blocks changes.

Discover writable objects, then prioritize root-owned configuration, scripts, binaries and parents under /etc, /opt, /usr/local, application paths and service working directories:

Why it works

Directory write plus traversal can allow replacement without direct file write. ACLs, sticky directories, immutable attributes and mount options can change the effective operation.

Worked example · hypothetical

Observation: a service script is read-only but its parent is writable. Test: inspect replacement rights and the service's actual path. Illustrative output: the caller can replace the exact consumed object. Interpretation: the control primitive exists; now verify privileged identity and trigger.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗