Show permission creep happening in one afternoon

short · 40 min · Objective 4.6

Task

Simulate three role changes for one identity, granting access each time without removing the old, then measure what the account can reach at the end. Permission creep is obvious in a diagram and invisible in an estate, and this puts a number on it.

Steps

  1. Create four groups standing in for departments, and give each group exclusive access to its own directory with real permissions.
  2. Create a user and put them in the first group. Record exactly which directories they can read and write.
  3. Simulate the first role change: add them to the second group, the way a ticket would, without removing the first.
  4. Repeat twice more.
  5. Now measure: write /tmp/effective.sh, which for a given username reports every directory it can read and every one it can write, by testing rather than by reading the group list.
  6. Compare the final result against what the person's CURRENT role requires, and record the excess in /tmp/creep.md. Then implement the fix — a role change is a full re-grant, not an addition — and measure again.

Verify

id labuser | tr ',' '\n' | grep -c "dept"
bash /tmp/effective.sh labuser | grep -c "writable"
python3 - <<'PY'
import subprocess
def w(u):
    out=subprocess.run(['bash','/tmp/effective.sh',u],capture_output=True,text=True).stdout
    return out.lower().count('writable')
before=w('labuser')
print('writable directories after three role changes:',before)
assert before>=3, 'creep did not accumulate - each change must ADD without removing'
PY
grep -ciE "excess|current role|re.grant" /tmp/creep.md

The assertion requires the account to have accumulated access from at least three roles. After your fix, re-run effective.sh and the count must fall to what the current role alone requires — that difference is the excess, and in a real estate it is the difference between one compromised account and four departments.

Notes

Note that effective.sh TESTS access rather than reading group membership. That distinction matters in practice: the group list is what was intended, and the test is what is true. They diverge through nested groups, direct ACLs and inherited permissions, and only one of them is what an attacker gets.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.