Cybersecurity Triage

Read-only, can be slow

Find Upload Files Writable Outside the Owner

You need to find uploaded files that group or other users can still modify.

Command

find fixtures/perm-audit/releases/2026-06-25/uploads -type f -perm /0022 -printf '%M %u:%g %p\n' | sort

Before you run this

System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.

When not to use it: Do not assume every group-writable upload is wrong without checking the service group model.

Expected output

Upload files with group-write or other-write permission bits.

System impact

Read-only, can be slow. Nothing changes. The command reports files writable by group or other.

Scope this to the smallest useful path or service on busy systems.

Recovery / rollback: no state is changed.

When to use it

Use when reviewing upload directories, generated exports, shared cache files, or restored media.

When not to use it

Do not assume every group-writable upload is wrong without checking the service group model.

Explanation-only example

Illustrated output, not a live lab run

This example is intentionally illustrative. It shows the command shape without killing real processes or changing your machine.

demo@lab:~$

$ find sample-files/perm-audit/releases/2026-06-25/uploads -type f -printf '%M %u:%g %p\n' | sort

-rw-r--r-- root:root sample-files/perm-audit/releases/2026-06-25/uploads/orphaned-upload.txt
-rw-rw-r-- root:root sample-files/perm-audit/releases/2026-06-25/uploads/customer-export.csv

$ find sample-files/perm-audit/releases/2026-06-25/uploads -type f -perm /0022 -printf '%M %u:%g %p\n' | sort

-rw-rw-r-- root:root sample-files/perm-audit/releases/2026-06-25/uploads/customer-export.csv

View commands shown

These are the commands shown in the sanitized transcript.

Commands shown

find fixtures/perm-audit/releases/2026-06-25/uploads -type f -printf '%M %u:%g %p\n' | sort
find fixtures/perm-audit/releases/2026-06-25/uploads -type f -perm /0022 -printf '%M %u:%g %p\n' | sort

next steps

Related commands

Hosting Operations Can be slow

Find Runtime Directories Writable Outside the Owner

Runtime directories often need writes, but the write boundary should be visible.

find fixtures/perm-audit/releases/2026-06-25/storage fixtures/perm-audit/releases/2026-06-25/uploads -type d -perm /0022 -printf '%M %u:%g %p\n' | sort

Cybersecurity Triage Can be slow

Find Writable Directories Missing the Sticky Bit

A writable log directory is not the same thing as a safe shared directory.

find fixtures/perm-audit -type d -perm -0002 ! -perm -1000 -printf '%m %u:%g %p\n' | sort

Cybersecurity Triage Can be slow

Find Config Files with Execute Bits

Config files do not usually need to be executable.

find fixtures/perm-audit -type f -perm /111 \( -path '*/config/*' -o -name '*.env' -o -name '*.conf' \) -printf '%M %u:%g %p\n' | sort

Hosting Operations Can be slow

Find Release Files Writable Outside the Owner

A release file that someone besides the owner can modify deserves a second look.

find fixtures/perm-audit/releases/2026-06-25 -type f -perm /0022 -printf '%M %u:%g %p\n' | sort

Cybersecurity Triage Sensitive output

Find World-Readable Secret-Looking Files

The fastest secret audit starts with readable files that look like secrets.

find fixtures/perm-audit -type f -perm -0004 \( -iname '*secret*' -o -iname '*.env' -o -iname '*token*' -o -iname '*key*' \) -printf '%M %u:%g %p\n' | sort

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.