Auditing System-Wide Access Control Discrepancies

In this lesson, you will learn how to detect "shadow permissions" by cross-referencing your standard UGO (User, Group, Others) settings, Access Control Lists (ACLs), and Mandatory Access Control (MAC) policies like SELinux.

The Problem of Shadow Permissions

When you manage a complex system, a file might look accessible based on its ls -l permissions, but an ACL could grant access to someone else, or an SELinux policy could block access entirely regardless of the file modes. "Shadow permissions" occur when these layers conflict, creating a discrepancy between what a user thinks is allowed and what the kernel actually permits.

To audit this, you must treat your security stack as a set of concentric rings. You need to ensure the most restrictive policy is the source of truth.

Automating the Cross-Reference

Because checking files manually is impossible at scale, you can automate a comparison using a shell script that pulls data from standard utilities. A simple audit check involves outputting the UGO mode, the ACL entries, and the SELinux security context for a target directory:

# Audit command for a specific directory
find /var/www/html -maxdepth 1 -exec sh -c '
  echo "File: {}"
  ls -ld {} | awk "{print \"UGO: \" \$1}"
  getfacl -p {} | grep "^user:"
  ls -Zd {} | awk "{print \"MAC: \" \$1}"
  echo "---"
' \;

Interpreting Discrepancies

When reviewing the output:

1. UGO vs. ACL: If the UGO bits are rwx------ but getfacl shows an extra user entry, you have a shadow permission. The file is more accessible than the standard mode implies.
2. ACL/UGO vs. MAC: If your UGO and ACLs grant full access, but ls -Zd shows a restrictive SELinux label (like httpd_sys_content_t), the MAC layer acts as a "hard ceiling." If you don’t account for the MAC policy, you might mistakenly believe a user has access when they are actually blocked.

By normalizing these three inputs into a single log, you can easily identify where a developer might have opened an ACL that bypasses intended UGO restrictions, or where a MAC policy is silently overriding your intended access model.

Key Takeaway: Always audit your security stack as a layered integration, as MAC policies and ACLs can create shadow permissions that remain invisible when viewing standard UGO file modes alone.