Restoring file permissions

upnort · 09-28-2019, 11:56 AM

After posting in this thread, I remembered I had a copy of an old shell script that restores file permissions on a stock Slackware system.

Might be useful to some folks. The original author is noted in the script.

I never had to use the script and never tested. Might be a decent rainy day exercise to create a VM, chmod 777 the entire system, and test the script. Perhaps a few bored or adventurous Slackers could test the script.

On my system I named the script /usr/local/sbin/restore_fileperms_from_manifest. I think I found the script here at LQ, but many years ago.

Have fun.

Code:

#!/bin/bash
# Copyright 2005, 2006  CTSMacon LLC., Macon, GA, USA
# All rights reserved.
#
# Redistribution and use of this script, with or without modification, is
# permitted provided that the following conditions are met:
#
# 1. Redistributions of this script must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
#
#  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
#  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO
#  EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
#  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
#  OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
#  OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
#  ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

# Howdy folks!
#
# Some one on IRC had their box completely hosed due to someone running a
#   "chmod -R 777 /" like a newb, so I banged up this script to fix it.
# Hope y'all enjoy.

# Alan Hicks

# ----------------------------------------------------------------------------
# This script will restore all default permissions on a Slackware box
# This may work with other UNIXs as well, but you'll need a file
# in the same way as a massaged MANIFEST file in Slackware

# You MUST have a file called MANIFEST in the directory you are calling
# this script from that contains a list of all the files you want
# changed and their correct permissions and ownership.  This is easily
# done in Slackware by removing all lines that begin with "+" or "|"
# in the file.
#
# The following works fine on Slackware.
#
# bunzip2 MANIFEST.bz2
# mv MANIFEST file
# egrep "^[d-]" file > MANIFEST

(while read line; do

  # Tag the filename
  PATH_NAME="$( echo $line | awk '{print $6}' )"

  # Tag the permissions
  FULL_PERM="$(echo $line | cut -c 2-10 )"
  OWNER_GROUP="$( echo $line | awk '{print $2}' | sed -e s+/+:+ )"

  OWN_PERMS="$(echo $FULL_PERM | cut -c 1-3 )"
  GROUP_PERMS="$(echo $FULL_PERM | cut -c 4-6 )"
  ALL_PERMS="$(echo $FULL_PERM | cut -c 7-9 )"

  # Read in owner permissions (and the suid bit!)
  if [ "$( echo $OWN_PERMS | cut -c 1)" = "r" ]; then
    READ=4
  else
    READ=0
  fi
  if [ "$( echo $OWN_PERMS | cut -c 2)" = "w" ]; then
    WRITE=2
  else
    WRITE=0
  fi
  if [ "$( echo $OWN_PERMS | cut -c 3)" = "x" ]; then
    EXE=1
  else
    EXE=0
  fi
  if [ "$( echo $OWN_PERMS | cut -c 3)" = "s" ]; then
    SUID=4
    EXE=1
  else
    SUID=0
    EXE=0
  fi

OWN=$(( $READ + $WRITE + $EXE ))

  # Read in group permissions (and the sgid bit!)
  if [ "$( echo $GROUP_PERMS | cut -c 1)" = "r" ]; then
    READ=4
  else
    READ=0
  fi
  if [ "$( echo $GROUP_PERMS | cut -c 2)" = "w" ]; then
    WRITE=2
  else
    WRITE=0
  fi
  if [ "$( echo $GROUP_PERMS | cut -c 3)" = "x" ]; then
    EXE=1
  else
    EXE=0
  fi
  if [ "$( echo $GROUP_PERMS | cut -c 3)" = "s" ]; then
    EXE=1
    SGID=2
  else
    SGID=0
    EXE=0
  fi

GROUP=$(( $READ + $WRITE + $EXE ))

  # Read in world permissions (and the sticky bit!)
  if [ "$( echo $ALL_PERMS | cut -c 1)" = "r" ]; then
    READ=4
  else
    READ=0
  fi
  if [ "$( echo $ALL_PERMS | cut -c 2)" = "w" ]; then
    WRITE=2
  else
    WRITE=0
  fi
  if [ "$( echo $ALL_PERMS | cut -c 3)" = "x" ]; then
    EXE=1
  else
    EXE=0
  fi
  if [ "$( echo $ALL_PERMS | cut -c 3)" = "t" ]; then
    STICKY=1
    EXE=1
  else
    STICKY=0
    EXE=0
  fi

ALL=$(( $READ + $WRITE + $EXE ))

OTHER=$(( $SUID + $SUID + $STICKY ))

echo chmod -R $OTHER$OWN$GROUP$ALL /$PATH_NAME
echo chgrp $OWNER_GROUP /$PATH_NAME

done) < MANIFEST

Alien Bob · 09-29-2019, 07:07 AM

This script has been available for download from http://www.slackware.com/~alien/tool...om_manifest.sh for the last 10+ years.
But it's good to bring it to attention of new users again.

upnort · 09-29-2019, 11:57 AM

Good! My memory is fuzzy about where I found the script, oh so long ago.

Firerat · 09-29-2019, 07:43 PM

it won't work, no need to test it you only have to read it

Code:

egrep "^[d-]" file > MANIFEST

is grabbing all the files and dirs

./ will be listed many times, the chmod -R is going to reset things to 755

the .new files may not exist
and the "current" config files will stay 755 from the all chmod -R 755 ./

Code:


drwxr-xr-x root/root         0 2019-08-21 14:01 ./
drwxr-xr-x root/root         0 2019-08-21 14:01 etc/
drwxr-xr-x root/root         0 2019-08-21 14:01 etc/acpi/
-rwxr-xr-x root/root       314 2019-08-21 14:01 etc/acpi/acpi_handler.sh.new
drwxr-xr-x root/root         0 2019-08-21 14:01 etc/acpi/events/
-rw-r--r-- root/root       635 2019-08-21 14:01 etc/acpi/events/default
drwxr-xr-x root/root         0 2019-08-21 14:01 etc/rc.d/
-rwxr-xr-x root/root       552 2019-08-21 14:01 etc/rc.d/rc.acpid
<snip>
drwxr-xr-x root/root         0 2019-08-30 13:29 ./
drwxr-xr-x root/root         0 2019-08-30 13:29 bin/
-rwxr-xr-x root/root   1164640 2019-08-30 13:29 bin/bash5.new
drwxr-xr-x root/root         0 2019-08-30 13:29 install/
-rw-r--r-- root/root       362 2019-08-30 13:29 install/doinst.sh
-rw-r--r-- root/root       959 2019-08-30 13:29 install/slack-desc
drwxr-xr-x root/root         0 2019-08-30 13:29 usr/
drwxr-xr-x root/root         0 2019-08-30 13:29 usr/doc/
drwxr-xr-x root/root         0 2019-08-30 13:29 usr/doc/bash-5.0/
-rw-r--r-- root/root     17220 2012-02-27 18:47 usr/doc/bash-5.0/AUTHORS
-rw-r--r-- root/root     39269 2019-01-02 08:38 usr/doc/bash-5.0/CHANGES
-rw-r--r-- root/root     21790 2018-05-29 15:19 usr/doc/bash-5.0/COMPAT

suids/sticky would get wiped by the multiple chmod -R ./

nice idea , bad script,
and it will be very slow with all that UUOE

Alien Bob · 09-30-2019, 12:39 AM

Can we just snuff the know-it-all. If you like Debian so much, kindly leave the Slackware users to their sorry self, we'll manage OK.

Richard Cranium · 09-30-2019, 02:40 AM

Quote:

Originally Posted by Firerat

it won't work, no need to test it you only have to read it

Code:

egrep "^[d-]" file > MANIFEST

is grabbing all the files and dirs

./ will be listed many times, the chmod -R is going to reset things to 755

Code:

egrep "^[d-]" -a file | sort -u -d -k6 > MANIFEST

should help. If I were to use it, I'd remove the -R from the chmod in the script (I wouldn't care to have my non-root users to have their home directories suddenly owned by root) and add some .new detection as well.

Firerat · 09-30-2019, 05:02 AM

Quote:

Originally Posted by Alien Bob

Can we just snuff the know-it-all. If you like Debian so much, kindly leave the Slackware users to their sorry self, we'll manage OK.

the script is bad, you only have to read it to know that.

And yes, I do like Debian
I'm a fairly recent Debian user.
Started with Redhat 5.2
used Slackware for a year or two
LFS for a few years after that
reluctantly Ubuntu for Android toolchain
Then Debian

bsds now and again, slackware on laptop once in a while to see if it improved

Firerat · 09-30-2019, 05:24 AM

Quote:

Originally Posted by Richard Cranium

Code:

egrep "^[d-]" -a file | sort -u -d -k6 > MANIFEST

should help. If I were to use it, I'd remove the -R from the chmod in the script (I wouldn't care to have my non-root users to have their home directories suddenly owned by root) and add some .new detection as well.

yeap

the scenario according to the script is someone chmod 777 -R ./
so everything needs to be fixed, home dirs and block/char

had a little look at it,
right now I have the script doing the exact same thing, only much faster

so add the sort and do dirs first ( ^d )
then do files/block/char ( ^[bc-] )

Code:

#!/bin/bash
declare -A perms=( [r]="4" [w]="2" [x]="1" [-]="0" [s]="1" [t]="1" )
(while read line
do
  LINE=($line)
  # [0]="Permisions" [1]="Owner/Group [2]="Size/Major/Minor"
  # [3]="Date" [4]="Time" [5]="Path/file"
  
  NAME="${LINE[5]}"
  PERM="${LINE[0]:1}"
  OWNER_GROUP="${LINE[1]%/*}:${LINE[1]#*/}"

  unset SPERM
  [[ ${PERM:2:1} == s ]] && SPERM=$(( ${SPERM:-0} + 4 ))
  [[ ${PERM:5:1} == s ]] && SPERM=$(( ${SPERM:-0} + 2 ))
  [[ ${PERM}     =~ t ]] && SPERM=$(( ${SPERM:-0} + 1 ))
  #printf "%s" ${NAME}
  #printf " %s" ${PERM}
  for p in r w x - s t
  do
    PERM=${PERM//${p}/${perms[${p}]}}
  done
  #printf " %s" ${SPERM}${PERM}

  CHMOD=$(
    printf "%d" $(( ${PERM:0:1} + ${PERM:1:1} + ${PERM:2:1} )) 
    printf "%d" $(( ${PERM:3:1} + ${PERM:4:1} + ${PERM:5:1} )) 
    printf "%d" $(( ${PERM:6:1} + ${PERM:7:1} + ${PERM:8:1} ))
    )
  #printf " %s\n" ${SPERM}${CHMOD}
  echo chmod -R ${SPERM}${CHMOD} ${MNTPOINT}/${NAME}
  echo chgrp ${OWNER_GROUP} ${MNTPOINT}/$NAME
done) < MANIFEST
#TODO split manifest

threw a mountpoint in
like I said, it does exactly the same as original
so it is also broken

I may add touch to fix timestamps, but that may not be worth it

started this

Code:

ChkManifest () {
  fileis=( $(file -i "${1}") ) 
  case ${fileis[1]:0:(-1)} in
    application/x-bzip2)
      GREP="bzgrep"
      ;;
    text/plain)
      GREP="grep"
      ;;
    *) cat <<-EOF
<tabs>"${fileis[1]:0:(-1)}" not handled yet
<tabs>only bzip2 or plain text for now
<tabs>EOF
      exit 1
      #TODO move error reports to trap
      ;;
  esac
  $GREP -q -m1 "||   Package:" ${1} || exit 4
#   || cat <<-EOF
#   "${1}" does not appear to be a valid Manifest
#   EOF
#TODO move error reports to trap
}

Code:

 
ReadManifest () {
  $GREP "^[$1]" "${2}"
  # going to need to sort at some point
  # might as well do it here
}

Firerat · 09-30-2019, 06:14 AM

seems a little easier than I thought it would be

Code:

#!/bin/bash
GetManifest () {
sort -u -d -k6 <(bzgrep -E "^[d]" MANIFEST.bz2 )
}

while read line
do
    LINE=($line)
    [[ ${LINE[5]} == ./ ]] \
        && echo ${LINE[0]} ${LINE[5]} \
        && continue
    [[ ${LINE[0]} == ${PREV_LINE[0]} || ${LINE[0]} == drwxr-xr-x ]] \
        && continue
    PREV_LINE=( $line )
    echo ${LINE[0]} ${LINE[5]}      
done< <(GetManifest)

Edit: drop that bold continue

Code:

[[ ${LINE[0]} == ${PREV_LINE[0]} || ${LINE[0]} == drwxr-xr-x ]] \
    || echo ${LINE[0]} ${LINE[5]}
    PREV_LINE=( $line )

End Edit

I've not gone deep with checking that, but it does seem to be doing the right thing

Code:

drwxr-xr-x ./
drwx------ etc/cups/ssl/
drwxr-x--- etc/openvpn/certs/
drwx------ etc/polkit-1/rules.d/
drwxr-x--- etc/sudoers.d/
drwx--x--- root/
drwx--x--x run/sudo/
drwxrwxrwt tmp/
drwxrwxr-x usr/doc/Linux-HOWTOs/
drwxr-sr-x usr/doc/cdrtools-3.01/READMEs/
drwxrwxr-x usr/doc/cyrus-sasl-2.1.27/doc/
dr-xr-xr-x usr/doc/wpa_supplicant-2.9/examples/
drwxrwx--- var/cache/cups/
drwxrwxr-x var/cache/cups/rss/
drwx--x--x var/db/sudo/
drwx------ var/db/sudo/lectured/
drwxr-x--- var/lib/bsdgames/sail/
drwx------ var/lib/nfs/sm/
drwxrwxr-x var/lib/ntp/
drwxrwx--- var/lib/php/
drwx------ var/lib/pkgtools/setup/tmp/
drwxrwx--- var/lib/samba/bind-dns/
drwx------ var/lib/samba/private/
drwxrwx--T var/lib/stunnel/
drwx------ var/lib/udisks/
drwxrwxrwt var/lock/
drwxrwxr-x var/lock/sane/
drwx------ var/man/cat1/
drwxrwxr-x var/run/
dr-x--x--x var/run/cups/certs/
drwxrwx--T var/spool/atjobs/
drwxr-x--x var/spool/cron/
drwxr-x--- var/spool/cron/cronstamps/
drwx--x--- var/spool/cups/
drwxrwx--T var/spool/cups/tmp/
drwxrwxrwt var/spool/mail/
drwx------ var/spool/postfix/active/
drwx-wx--- var/spool/postfix/maildrop/
drwx------ var/spool/postfix/private/
drwx--x--- var/spool/postfix/public/
drwx------ var/spool/postfix/saved/
drwxrwxrwt var/spool/samba/
drwxrwsrwt var/spool/slrnpull/out.going/
drwxrwxr-x var/spool/uucp/
drwxrwxrwt var/tmp/
drwxr-sr-x var/www/error/include/

so all that is left is some checks to see if the file exists accounting for .new
maybe throw a stat in to see if we need to chmod
although, the stat may take just as long as a chmod anyway

I may have overlooked some pieces , but I'm sure you guys can figure it out and put it all together.

Firerat · 09-30-2019, 06:49 AM

just noticed we have some sticky only

this should resolve that

Code:

declare -A perms=( [r]="4" [w]="2" [x]="1" [-]="0" [s]="1" [t]="1" [T]="0" )
<snip>
  [[ ${PERM}  =~ [tT] ]] && SPERM=$(( ${SPERM:-0} + 1 ))
  for p in r w x - s t T

Richard Cranium · 09-30-2019, 12:33 PM

Thank you, @Firerat; these are helpful responses.

FWIW, I found it necessary to add the "-a" to the egrep line due to one of the file names in the manifest containing UTF characters (it's in the kbd-1.15.3-x86_64-2.txz portion of the file); egrep would stop processing the manifest file at that point with a Binary file MANIFEST matches message.

upnort · 09-30-2019, 12:52 PM

Outside the one-off comments, has anybody created an updated script? I have a spare Current VM to test. Perhaps a chmod -R 777 / and then run the updated script.

crts · 09-30-2019, 07:57 PM

Quote:

Originally Posted by Firerat

like I said, it does exactly the same as original
so it is also broken

How productive ... Slackware would be truely lost without your "deep, thoughtful" insights.

Quote:

Originally Posted by upnort

Outside the one-off comments, has anybody created an updated script? I have a spare Current VM to test. Perhaps a chmod -R 777 / and then run the updated script.

You could try the following script:

Code:

#!/usr/bin/bash

MANIFEST="${1:-./MANIFEST}"
ROOT="$2"

transform_perms() {
        local f="${1,,}" # field to be transformed into valid chmod permission (u,g,o)
        local p="${2}" # the permission as read from the manifest file
        local s=${3:-s}
        local r

        case ${p:2} in
        x|-) # must remove s-bit explicitly
                r="$f=${p//-/},${f}-${s,,}"
                ;;
        s|t) # lower case s-bit implies exec bit 
                r="$f=${p//-/}x"
                ;;
        *)
                r="$f=${p//-/}"
                ;;
        esac

        echo "${r,,}"
}

reset_perms() {
        local read perm user_group size date time file u g o filepath

        while read perm user_group size date time file;do
                [[ ${perm:0:1} == [^hdbcps-] ]] && continue;

                u=$(transform_perms u "${perm:1:3}")
                g=$(transform_perms g "${perm:4:3}")
                o=$(transform_perms o "${perm:7:3}" t)

                [[ ${perm:0:1} == h ]] && file="${file% link to *}"

                filepath="$ROOT/$file"
                chown ${user_group/\//:} "$filepath"
                chmod $u,$g,$o "$filepath"
        done < "$MANIFEST"
}

reset_perms

Just do me a favor and run

Code:

# chmod -R 7777 / # yes, that is four 7s

to "screw" up the system in your VM. I would like to know if it handles the SUID/SGID bits for directories correctly because the way chmod handles them is not trivial.

Richard Cranium · 09-30-2019, 09:07 PM

Quote:

Originally Posted by crts

How productive ... Slackware would be truely lost without your "deep, thoughtful" insights.

That was not necessary. There are bugs in the original script.

I would prefer @Firerat to help fix problems versus just pointing them out; @Firerat was providing code examples that incrementally improved the original script.

"Friends come and go; enemies accumulate."

EDIT: I do like that your script uses the symbolic parameters to chmod versus the numeric ones.

crts · 09-30-2019, 09:29 PM

Quote:

Originally Posted by Richard Cranium

EDIT: I do like that your script uses the symbolic parameters to chmod versus the numeric ones.

It does so because you cannot remove an erroneous SUID/SGID bit with the numeric ones. From the manpage:

Code:

SETUID AND SETGID BITS
       chmod  clears  the  set-group-ID  bit  of a regular file if the file's
       group ID does not match the user's effective group ID or  one  of  the
       user's supplementary group IDs, unless the user has appropriate privi‐
       leges.  Additional restrictions may cause  the  set-user-ID  and  set-
       group-ID  bits  of MODE or RFILE to be ignored.  This behavior depends
       on the policy and functionality of the underlying chmod  system  call.
       When in doubt, check the underlying system behavior.

       chmod preserves a directory's set-user-ID and set-group-ID bits unless
       you explicitly specify otherwise.  You can set or clear the bits  with
       symbolic  modes  like u+s and g-s, and you can set (but not clear) the
       bits with a numeric mode.

The original script is only supposed to handle damaged permissions whose s/t-bits are still correct. However, someone may also have inadvertently damaged those, too. This why I decided to use the symbolic modes.