Check www-data folder and crontab permissions

check.sh

#!/bin/bash

set -u;

root="/opt/permission-tester/";
output=`mktemp -t permission-tester.XXXXXXXXXX`;

#--------------------------------------------------
# Check excluded folders exist, and are noexec
#--------------------------------------------------

{ cat "/opt/permission-tester/groups/www-data"; echo; } | while read F; do
	F="${F#'^'}";
	if [ "$F" != "" ]; then
		if [ ! -d "$F" ]; then
			echo "Unknown folder: $F";
		else
			M=`stat --format '%m' "${F}"`;
			if [ `findmnt -M "${M}" | grep noexec | wc -l` -ne 1 ]; then
				echo "Allows exec: $F (${M})";
			fi
		fi
	fi
done

#--------------------------------------------------
# Scans
#--------------------------------------------------

	# https://askubuntu.com/questions/746818/terminal-list-all-directories-for-which-a-user-or-group-has-write-permission
	# https://unix.stackexchange.com/questions/358122/exclude-a-list-of-directories-from-unix-find-command

find / \( $(printf " -path %s -o " $(cat "/opt/permission-tester/exclude"; echo)) -false \) -prune -o -type d -print0 2> "${output}" | \
	grep -vzZEf "/opt/permission-tester/groups/www-data" | \
	sudo -u "www-data" xargs -0 sh -c 'for p; do [ -w "$p" ] && echo "www-data: $p"; done' >> "${output}";

#--------------------------------------------------
# Crontab
#--------------------------------------------------

	# Cannot just use "-l" as no permission check
	# is done if a crontab entry does not exist.

if (crontab -u "www-data" -l 2>/dev/null ; echo "0 0 * * * whoami") | sort - | uniq - | crontab -u "www-data" - > /dev/null 2>&1; then
	echo "The www-data user can use the crontab command" >> "${output}";
fi

find "/var/spool/cron/crontabs" -type f >> "${output}";

#--------------------------------------------------
# Email
#--------------------------------------------------

if [ -s "${output}" ]; then
	echo;
	echo "Permission issues...";
	echo;
	cat "${output}";
	echo;
fi

#--------------------------------------------------
# Cleanup
#--------------------------------------------------

rm "${output}";