Linux file permissions control who can read, write or execute a file, split across three classes: the owner, the group, and everyone else. Privilege escalation often starts with a permission mistake — a file or directory that a low-privilege user can write to but a privileged process trusts.
What is Linux file permissions?#
Every file and directory has an owner, a group, and a permission set of read (r), write (w) and execute (x) for three classes: owner, group and other (everyone else). ls -l shows them as a 10-character string like -rwxr-xr--.
| Symbol | Meaning |
|---|---|
r | Read the file / list a directory |
w | Modify the file / create & delete entries in a directory |
x | Execute the file / enter (traverse) a directory |
Numerically, chmod 750 means rwx for owner, r-x for group, nothing for other.
Why LinPEAS checks linux file permissions#
The most common Linux escalation is: a privileged process (root cron job, systemd service, SUID binary) reads or executes a file that a low-privilege user can modify. LinPEAS therefore hunts for writable files and directories that you own or that are world/group-writable — especially root-owned executables and scripts run by root.
What a normal configuration looks like#
System binaries are typically owned by root and not world-writable (e.g. 755). Configuration in /etc is usually 644 or stricter. Your own files live under your home directory. Sensitive files like /etc/shadow are readable only by root.
Why it can be security-sensitive#
A world-writable file that root executes is game over; you replace its contents and wait. A writable directory in a privileged process's path lets you plant or swap files. Even a readable-but-secret file (a backup of /etc/shadow, an SSH private key) is a serious finding.
Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.
How to check it manually#
Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:
ls -l /path/to/filefind / -xdev -type f -perm -0002 ! -type l 2>/dev/nullfind / -xdev -type d -perm -0002 2>/dev/nullfind / -writable -type f 2>/dev/null | grep -vE '^/proc|^/sys'Defensive remediation#
- Remove world-writable bits from anything privileged:
chmod o-w <file>. - Ensure scripts run by root are owned by root and writable only by root.
- Restrict secrets to their owner:
chmod 600for keys, keep/etc/shadowroot-only. - Audit directories in privileged search paths for group/other write access.
Sources & references
- HackTricks: Linux privilege escalation
- GTFOBins — abuse techniques for standard binaries
- PEASS-ng repository — reviewed 20260908-dffb9496