In this lesson, you will learn how to identify "permission drift"—the gradual, unauthorized changes to file ownership or access modes—within user home directories.
Understanding Permission Drift
Even with well-defined account lifecycle policies, manual intervention or misconfigured automation scripts can accidentally alter the permissions of a user's directory. Permission drift occurs when a file that should be owned by alice is suddenly owned by root, or when a private directory inadvertently becomes readable by the entire system. Because user directories often contain sensitive configuration files and SSH keys, maintaining strict integrity is vital for security.
Scanning for Anomalies
To audit these structures, we rely on the find command to compare actual filesystem metadata against your established security policy. For instance, if your policy dictates that all directories under /home must be owned by the user they belong to and have no "world-writable" bits (sticky bits aside), you can run a targeted scan:
# Find files in /home not owned by their respective user
find /home -maxdepth 2 -not -user $(stat -c %U {})
# Find directories that are world-writable (a common security drift)
find /home -type d -perm -0002
Remediation Strategies
Once you detect a discrepancy, you must remediate it to restore the "ground truth." If you find that a user's directory has drifted due to a manual chown mistake, you can use the chown and chmod commands to force the structure back to its intended state:
# Force ownership back to the specific user and group
chown -R alice:alice /home/alice
# Ensure the home directory is not accessible by others
chmod 700 /home/alice
Integrity auditing is not a one-time setup; it is a defensive habit. By periodically scanning these directories, you ensure that even if a user account is compromised, the broader system remains protected because the file permissions effectively contain the scope of that account.
Key Takeaway: Auditing user permissions requires comparing current filesystem metadata against your security policy and using find to proactively detect and revert ownership drift before it can be exploited.