Is there a list of safe/normal/expected SUID files?

Question

Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to be safe.

How, other than by long experience with linux systems, is one able to scan the list returned by find / -perm -u=s -type f 2>/dev/null for the potential needle in a haystack? Is there a list of known/safe/expected SUID executables that one could compare against? Or a script that does this for you?

Answer 1

Is there a list of known/safe/expected SUID executables that one could compare against?

Not really, largely because all modern Linux distributions are package-based. There's no single monolithic standard set of files, because installations vary easily based on which packages are installed. That said, packages also provide listings of included files, making it easy for you to check whether a SUID binary is legitimately installed or not.

Or a script that does this for you?

There are two simple ways to approach this - you can verify individual files against their package, or you can dump a list of SUID files out of all packages.

For example, let's say you're looking at /usr/bin and you're worried about the chfn SUID executable. On an RPM based distribution, you can Verify the file against the package:

# rpm -Vf /usr/bin/chfn; echo $?
0
#

(The 0 exit code indicates that no discrepancies were found; the file is as expected based on the package parameters. You can see a list of the checks that RPM Verify performs.)

On a Debian-based distribution (like Ubuntu, Mint, ...) you'll be dealing with deb packages, which have a less centralized approach than RPMs. The same overall effect can be achieved after installing apt-file and debsums:

# apt-file search /usr/bin/chfn
passwd: /usr/bin/chfn
# debsums passwd | grep /usr/bin/chfn
/usr/bin/chfn                                           OK
#

You could write a tool to enumerate package listings to find SUID files, to verify them, and to compare your list against a list of what's actually on the file system via find. (Note that with RPM, at least, you can verify all files in all packages with just rpm -Va, but you'll find that's a bit chatty and more than just SUID files).

For example, you could loop over all installed packages (rpm -qa) and, for each package, list out the SUID and SGID files:

# rpm -qlv util-linux-ng-2.17.2-12.28.el6_9.2.x86_64 | awk '$1 ~ /s/ {print $0}'
-rwsr-xr-x    1 root    root                    77560 Dec  5  2017 /bin/mount
-rwsr-xr-x    1 root    root                    53480 Dec  5  2017 /bin/umount
-rws--x--x    1 root    root                    20184 Dec  5  2017 /usr/bin/chfn
-rws--x--x    1 root    root                    20056 Dec  5  2017 /usr/bin/chsh
-rwxr-sr-x    1 root    tty                     12016 Dec  5  2017 /usr/bin/write
#

and use that to build your list of expected SUID files.