Show permission creep happening in one afternoon

short · 40 min · Objective 4.6

Task

Simulate three role changes for one identity, granting access each time without removing the old, then measure what the account can reach at the end. Permission creep is obvious in a diagram and invisible in an estate, and this puts a number on it.

Steps

  1. Create four groups standing in for departments, named dept1 through dept4, and give each group exclusive access to its own directory with real permissions.
  2. Create a user named labuser and put them in dept1. Record exactly which directories they can read and write.
  3. Simulate the first role change: add labuser to dept2 the way a ticket would, without removing dept1.
  4. Repeat twice more, adding dept3 then dept4, so by the end the account is in all four.
  5. Now measure: write /tmp/effective.sh, which takes a username as its one argument and, by TESTING access rather than reading the group list, prints one line per directory it can write in the exact form writable <path> and one line per directory it can only read as readable <path>. The Verify counts the writable lines, so that word must appear once for each writable directory.
  6. Compare the final result against what the person's CURRENT role requires, and record the excess in /tmp/creep.md. Then implement the fix — a role change is a full re-grant, not an addition — and measure again.

Verify

id labuser | tr ',' '\n' | grep -c "dept"
bash /tmp/effective.sh labuser | grep -c "writable"
python3 - <<'PY'
import subprocess
def w(u):
    out=subprocess.run(['bash','/tmp/effective.sh',u],capture_output=True,text=True).stdout
    return out.lower().count('writable')
before=w('labuser')
print('writable directories after three role changes:',before)
assert before>=3, 'creep did not accumulate - each change must ADD without removing'
PY
grep -ciE "excess|current role|re.grant" /tmp/creep.md

The assertion requires the account to have accumulated access from at least three roles. After your fix, re-run effective.sh and the count must fall to what the current role alone requires — that difference is the excess, and in a real estate it is the difference between one compromised account and four departments.

Notes

Note that effective.sh TESTS access rather than reading group membership. That distinction matters in practice: the group list is what was intended, and the test is what is true. They diverge through nested groups, direct ACLs and inherited permissions, and only one of them is what an attacker gets.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.