Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I accidentally wreaked unknown amounts of havoc on my web server by running

sudo chown -R myuser:mygroup * .*

in /var/www, not remembering that .* would include the parent directory (as ..). I realized what was happening after a second or so, but by then it was too late, half the directories in /var had been "re-owned". I know I can reset most of it with

sudo chown -R root:root /var

but what files are there that need to be owned by specific non-root users (or groups) that I would have to change manually?

This is on Gentoo, and here's a directory listing:

$ ls -l /var
drwxr-xr-x  9 root root 4096 May 12  2009 cache
drwxr-xr-x  4 root root 4096 Aug 20 22:49 db
drwxr-xr-x  3 root root 4096 Aug 20 22:42 dist
drwxr-xr-x  4 root root 4096 Nov  1  2009 edata
drwxr-xr-x  2 root root 4096 Jun 17  2008 empty
drwxr-xr-x  5 git  git  4096 Feb 13  2010 git
drwxr-xr-x 23 root root 4096 Jul 19 03:22 lib
drwxrwxr-x  3 root uucp 4096 Aug 12 00:14 lock
drwxr-xr-x 10 root root 4096 Aug 20 03:10 log
lrwxrwxrwx  1 root root   15 Nov  7  2008 mail -> /var/spool/mail
drwxr-xr-x 10 root root 4096 Aug 21 00:22 run
drwxr-xr-x  8 root root 4096 Feb 13  2010 spool
drwxr-xr-x  2 root root 4096 Jun 17  2008 state
drwxr-xr-x 13 root root 4096 Dec 23  2009 svn
drwxrwxrwt  5 root root 4096 Aug 14 01:53 tmp
drwxr-xr-x 13 root root 4096 Aug 11 20:21 www
drwxr-xr-x  2 root root 4096 Dec 14  2008 www-cache

I can provide listings of subdirectories if it would help but that gets pretty long pretty fast. (dist, edata, git, svn, and www are things I manage myself so ownership in those won't be an issue)

share|improve this question
I retagged with gentoo because that affects the directories in /var/. you might want to show what directories you have with an ls -l /var, that way people can help you by telling you what ownership those directories have for them. – xenoterracide Aug 21 '10 at 4:42
@xenoterracide: good idea, will do. (I would have tagged it with gentoo myself if I had enough rep to create the tag) – David Z Aug 21 '10 at 6:23
I believe there are some custom permissions involving /var/log/apache2 or some such... iirc – xenoterracide Aug 21 '10 at 6:57
Who knows whether (if /var is mounted on a separate fdisk) will upper ..* expansion obliterate all the /**/**...? if / is another drive another fs etc.. – Xsi Nov 25 '12 at 21:34
List directories that owned by a unknown user or group – user111840 Apr 24 '15 at 19:44
up vote 2 down vote accepted

Well, "/var" is generally for data generated by programs, so it may not be possible to tell you exactly who should own what without duplicating your system. I can think of two ways you might fix it:

  1. Set up another version of your web server on a spare or virtual machine and then check /var.
  2. Just change to root/root and then see what errors come up (most of the directories will have this ownership structure).

The downside to 1 is the amount of time it will take; the plus side being that it will be accurate. Item 2 is much faster but less accurate even if it's mostly true. The big problem here is that on an important production box 2 may not be feasible.

share|improve this answer
Thanks, I've been kind of thinking along the same lines. I actually did use option #2, namely chown everything to root:root, since I figured, like you, that I'd at least get most of them right that way. It did cause an error with mysql, though. (Thankfully just a personal website, so not a big deal if it goes down for a while) – David Z Aug 21 '10 at 6:39

I'd help you out but I no longer run gentoo so here's a faster way to find out than installing a VM. Download the latest tarball to a directory and extract it. mount proc and dev like you would for an install. chroot in and install whatever server daemons you've installed, you probably need to start them too. now run.

find /var ! -user root -ls

this should list all the files not owned by the root user.

If someone else has a gentoo system they could help him by just running this command

Here's a short list from my system (which is Arch Linux so distance will vary ) which might help out.

find /var -maxdepth 2 ! -user root -ls | sed -e 's/^/    &/'                        slave-iv
262147    4 drwx------   2 named    named        4096 Jul 22 15:49 /var/named
262151    4 -rw-------   1 named    named         234 Jul 22 15:49 /var/named/127.0.0.zone
262148    4 -rw-------   1 named    named        2938 Jul 22 15:49 /var/named/root.hint
262385    4 -rw-------   1 named    named         190 Jul 22 15:49 /var/named/localhost.zone
526002    4 drwx------   6 griff    users        4096 Aug  1 18:16 /var/tmp/kdecache-griff
529617    4 drwx------   3 kdm      kdm          4096 Aug 11 18:30 /var/tmp/kdecache-kdm
526893    4 drwx------   8 xenoterracide users        4096 Aug 20 10:37 /var/tmp/kdecache-xenoterracide
524523    4 drwxrwx--T   2 daemon   daemon       4096 Feb  4  2010 /var/spool/atd
529085    0 -rw-r--r--   1 named    named           0 Aug 15 03:21 /var/log/named.log
529330   16 -rw-r--r--   1 postgres root        14907 Aug 20 08:51 /var/log/postgresql.log
525625    0 -rw-r--r--   1 named    named           0 Aug  8 03:19 /var/log/named.log.1
524820    0 -rw-r--r--   1 named    named           0 Jul 18 03:19 /var/log/named.log.4
529165    0 -rw-r--r--   1 named    named           0 Jul 25 03:19 /var/log/named.log.3
525956    0 -rw-r--r--   1 named    named           0 Aug  1 03:19 /var/log/named.log.2
524864    4 drwx------   4 mysql    mysql        4096 Jun  1 01:10 /var/lib/mysql
524319    4 drwxr-xr-x   2 named    named        4096 Aug 19 01:04 /var/run/named
524309    4 drwxr-xr-x   2 dbus     dbus         4096 Aug 19 01:04 /var/run/dbus
524436    4 drwxr-xr-x   4 hal      hal          4096 Jun 10 17:47 /var/run/hald
share|improve this answer
just for some comparison my arch system has find /var ! -user root | wc -l 12672 files in var not owned by root. – xenoterracide Aug 21 '10 at 7:11
most of those appear to be in a kdetmp directory though – xenoterracide Aug 21 '10 at 7:28
I actually already had a VM set up as a duplicate of the affected server, but I'm not sure I can trust the ownerships there either since I might have run chmod -R root:root in the VM in addition to the server! But my main desktop runs Gentoo as well so I don't think any reinstalls will be necessary, it's just a matter of picking out which files in the tree need to have the owner changed. The find command should definitely help with that, thanks. – David Z Aug 21 '10 at 8:00
@David I wasn't suggesting a reinstall... just that you can get a system running it a chroot way faster than setting up a VM. – xenoterracide Aug 21 '10 at 8:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.