What files in /var need to have specific owners?

Question

I accidentally wreaked unknown amounts of havoc on my web server by running

sudo chown -R myuser:mygroup * .*

in /var/www, not remembering that .* would include the parent directory (as ..). I realized what was happening after a second or so, but by then it was too late, half the directories in /var had been "re-owned". I know I can reset most of it with

sudo chown -R root:root /var

but what files are there that need to be owned by specific non-root users (or groups) that I would have to change manually?

This is on Gentoo, and here's a directory listing:

$ ls -l /var
drwxr-xr-x  9 root root 4096 May 12  2009 cache
drwxr-xr-x  4 root root 4096 Aug 20 22:49 db
drwxr-xr-x  3 root root 4096 Aug 20 22:42 dist
drwxr-xr-x  4 root root 4096 Nov  1  2009 edata
drwxr-xr-x  2 root root 4096 Jun 17  2008 empty
drwxr-xr-x  5 git  git  4096 Feb 13  2010 git
drwxr-xr-x 23 root root 4096 Jul 19 03:22 lib
drwxrwxr-x  3 root uucp 4096 Aug 12 00:14 lock
drwxr-xr-x 10 root root 4096 Aug 20 03:10 log
lrwxrwxrwx  1 root root   15 Nov  7  2008 mail -> /var/spool/mail
drwxr-xr-x 10 root root 4096 Aug 21 00:22 run
drwxr-xr-x  8 root root 4096 Feb 13  2010 spool
drwxr-xr-x  2 root root 4096 Jun 17  2008 state
drwxr-xr-x 13 root root 4096 Dec 23  2009 svn
drwxrwxrwt  5 root root 4096 Aug 14 01:53 tmp
drwxr-xr-x 13 root root 4096 Aug 11 20:21 www
drwxr-xr-x  2 root root 4096 Dec 14  2008 www-cache

I can provide listings of subdirectories if it would help but that gets pretty long pretty fast. (dist, edata, git, svn, and www are things I manage myself so ownership in those won't be an issue)

Answer 1

Well, "/var" is generally for data generated by programs, so it may not be possible to tell you exactly who should own what without duplicating your system. I can think of two ways you might fix it:

1. Set up another version of your web server on a spare or virtual machine and then check /var.
2. Just change to root/root and then see what errors come up (most of the directories will have this ownership structure).

The downside to 1 is the amount of time it will take; the plus side being that it will be accurate. Item 2 is much faster but less accurate even if it's mostly true. The big problem here is that on an important production box 2 may not be feasible.

Answer 2

I'd help you out but I no longer run gentoo so here's a faster way to find out than installing a VM. Download the latest tarball to a directory and extract it. mount proc and dev like you would for an install. chroot in and install whatever server daemons you've installed, you probably need to start them too. now run.

find /var ! -user root -ls

this should list all the files not owned by the root user.

If someone else has a gentoo system they could help him by just running this command

Here's a short list from my system (which is Arch Linux so distance will vary ) which might help out.

find /var -maxdepth 2 ! -user root -ls | sed -e 's/^/    &/'                        slave-iv
262147    4 drwx------   2 named    named        4096 Jul 22 15:49 /var/named
262151    4 -rw-------   1 named    named         234 Jul 22 15:49 /var/named/127.0.0.zone
262148    4 -rw-------   1 named    named        2938 Jul 22 15:49 /var/named/root.hint
262385    4 -rw-------   1 named    named         190 Jul 22 15:49 /var/named/localhost.zone
526002    4 drwx------   6 griff    users        4096 Aug  1 18:16 /var/tmp/kdecache-griff
529617    4 drwx------   3 kdm      kdm          4096 Aug 11 18:30 /var/tmp/kdecache-kdm
526893    4 drwx------   8 xenoterracide users        4096 Aug 20 10:37 /var/tmp/kdecache-xenoterracide
524523    4 drwxrwx--T   2 daemon   daemon       4096 Feb  4  2010 /var/spool/atd
529085    0 -rw-r--r--   1 named    named           0 Aug 15 03:21 /var/log/named.log
529330   16 -rw-r--r--   1 postgres root        14907 Aug 20 08:51 /var/log/postgresql.log
525625    0 -rw-r--r--   1 named    named           0 Aug  8 03:19 /var/log/named.log.1
524820    0 -rw-r--r--   1 named    named           0 Jul 18 03:19 /var/log/named.log.4
529165    0 -rw-r--r--   1 named    named           0 Jul 25 03:19 /var/log/named.log.3
525956    0 -rw-r--r--   1 named    named           0 Aug  1 03:19 /var/log/named.log.2
524864    4 drwx------   4 mysql    mysql        4096 Jun  1 01:10 /var/lib/mysql
524319    4 drwxr-xr-x   2 named    named        4096 Aug 19 01:04 /var/run/named
524309    4 drwxr-xr-x   2 dbus     dbus         4096 Aug 19 01:04 /var/run/dbus
524436    4 drwxr-xr-x   4 hal      hal          4096 Jun 10 17:47 /var/run/hald