I have a security audit requirement to produce a list of files that a specific list users have access to. In other words, I'm trying to use find to search files which user1 owns OR user2 owns OR user3 owns, and so on. Can this be done on one command line or do I need to use a for loop and just loop through the user list? I was trying to do something like:
find ./* -user bob -user jane
Which of course, does not work. Perhaps I need to try a different angle. Any suggestions on using find in this way or an alternative method would be greatly appreciated.
find ./* is redundant. find recurses, so find . is sufficient.
Find takes the -o option for or, and lets you group with ( ). You must quote them so the shell doesn't do silly things like try and put those as commands in a subshell.
What kind of access? (Read access? Write access? Execute access? Read and write access?) Having access to a file and being a file's owner are two VERY different things. A file with mode 777 can be accessed by every user on your system that can read or search the directory in which that file resides.
The find commands proposed so far in this thread do not in any way, shape, or form determine which files can be read, written, executed, or searched by any given user.
Fine question Don. And good point. In this case, I believe the auditor is looking to see exactly what the permission bits are set to for files with specific users and groups (haven't included that part yet). Ultimately, I think he actually wants to see the ACL's (if any) associated with those particular files.
You will usually find that this forum can provide much better help and provide it sooner, if you state all of the requirements up front. When you hide some of the requirements (or add on new requirements after an initial question has been answered) you waste a lot of time for the volunteers who are trying to help you.
Thanks for all the input y'all. I think I've found a reasonable solution. I ended up with a nested for statement that looks like this:
for p in /u01 /u02 /home; do for i in `find $p -type f -uid +100`; do getfacl $i; done; done >> output.txt
I entered this on the command line. It loops through the directories /u01, /u02 and /home using the find command to search those directories for regular files (-type f) with uid greater than 100 (-uid +100). It then uses the results of that find command to get the ACL for each file found (getfacl $i) and send the output to ouptput.txt
Haha, yeah I do tend to make things more complicated sometimes. That' s working much better. One question though, the "+" sign before the redirectors, I don't understand that one. I got an error and had to change it from
and look at the description of the -exec primary. The + tells find to pass multiple filenames to getfacl instead of invoking getfacl once for each found filename.
Note also that using /; instead of + or \; should have resulted in a diagnostic from find saying something like:
find: -exec: no terminating ";" or "+"
Please show us the exact command line you entered and the exact diagnostic message(s) that find produced.
On a Solaris system, using \; instead of + should produce the same results, but consume a lot more system resources doing so.
This is what I remember:
it was a Solaris script, when running on a very large directory tree. There was no error message, but it did only a fraction of the changes.
I simply added HP-UX to the existing exception for Linux, and then it worked.
And I did not further investigate, and even forgot about the script.
But since I always have \; in my HP-UX scripts.