One quick security trick is to run a find command to take inventory of the SUID and SGID files on your system. You could save the output to a text file, so that you can verify whether anything got added the next time you run the command. Your command would look something like this:

sudo find / -type f \( -perm -4000 -o -perm 2000 \) > suid_sgid_files.txt

Here's the breakdown:

• /: We're searching through the entire filesystem. Since some directories are only accessible to someone with root privileges, we need to use sudo.
• -type f: This means that we're searching for regular files, which would include executable program files and shell scripts.
• -perm 4000: We're searching for files with the 4000, or SUID, permission bit set.
• -o: The or operator.
• -perm 2000: We're searching for files with the 2000, or SGID, permission bit set.
• >: And, of course, we're redirecting the output into the suid_sgid_files.txt text file with the > operator.

Note that the two -perm items need to be combined into a term that's enclosed in a pair of parentheses. In order to prevent the Bash shell from interpreting the parenthesis characters incorrectly, we need to escape each one with a backslash. We also need to place a blank space between the first parenthesis character and the first -perm, and another between the 2000 and the last backslash. Also, the and operator between the -type f and the -perm term is understood to be there, even without inserting -a. The text file that you create should look something like this:

/usr/bin/chfn
/usr/bin/chsh
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/mount
/usr/bin/su
/usr/bin/umount
/usr/bin/sudo
/usr/bin/pkexec
/usr/bin/crontab
/usr/bin/passwd
/usr/sbin/pam_timestamp_check
/usr/sbin/unix_chkpwd
/usr/sbin/usernetctl
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/lib64/dbus-1/dbus-daemon-launch-helper

Optionally, if you want to see details about which files are SUID and which are SGID, you can add in the -ls option:

sudo find / -type f \( -perm -4000 -o -perm 2000 \) -ls > suid_sgid_files.txt

Now, let's say that Maggie, for whatever reason, decides to set the SUID bit on a shell script file in her home directory:

[maggie@localhost ~]$ chmod 4755 bad_script.sh

[maggie@localhost ~]$ ls -l
total 0
-rwsr-xr-x. 1 maggie maggie 0 Nov  7 13:06 bad_script.sh
[maggie@localhost ~]$

Run the find command again, saving the output to a different text file. Then, do a diff operation on the two files to see what changed:

[donnie@localhost ~]$ diff suid_sgid_files.txt suid_sgid_files2.txt
17a18
> /home/maggie/bad_script.sh
[donnie@localhost ~]$

The only difference is the addition of Maggie's shell script file.