How to check and fix the permissions to avoid writing (chmod o-rwx /home/*)

Xeratul · 01-17-2011, 11:50 PM

Hello,

I would like not check first, and if not ok, then to write the permssisions. Means no use to write endessly on disk if not needed.
How to check and fix the permissions to avoid writing (chmod o-rwx /home/*) ?

thanks is someone has any ideas for shortest linux solutions?

Thank you in advance!
Cheers

cin_ · 01-18-2011, 01:30 AM

Code:

# stat /home/* --printf=%A"\n"
drwxr-xr-x
drwxr-xr-x
drwxr-xr-x
drwxr-xr-x
# stat /home/* --printf=%a"\n"
755
755
755
755
#

Seems the best way to get the information, check man stat for more formatting options...

From there I'd write a script that only calls the files necessary and chmod's them.

The 'o-rwx' argument suggests that you want to make the files wholly unavailable by groupid... what you could do is alter the umask() for each user, to avoid doing this again in the future.

A.Thyssen · 01-18-2011, 06:44 PM

Another method is using perl...

Code:

  perl -e 'printf "%o\n", (stat(shift))[2];' ~
  40755

the '40000' means it is a directory. Note you need to print in Octal!

I wrote a script that reads a separate meta file to ensure my whole home has correct permissions depending on location (public or private), executable status, and allow me to say things like
bin/ -- all executable files
bin/admin/ -- private executable scripts
bin/admin/*.template -- non-executable data for a mailing script

Though the data in my permission file looks like...

Code:

#                           DIRS  EXEC  DATA
bin/                         755   755   644    R
bin/admin/                   700   700   700
bin/admin/*.template                     600

The columns are direction, executable, datafile permissions and 'R' mean recurse into deeper sub-directories (directory, which end in '/', specifications only).

My permissions script "do_perms" has works for me for years, though I am looking for a better program, or improvements that would allow me to specify specific what files I am refering to better, without me needing to specify EVERY file.