Should /usr owner be root?

Question

After having installed the MySQL database on openSUSE I realized that for all files in /usr/bin the owner was changed to the "mysql" user of the "mysql" group. Maybe there was some mistake of mine. The worst problem was with the /usr/bin/sudo command, which obviously did not work, but I've taken back the ownership to root (having logged to root) and it is OK now.

Should I change owner of all files in /usr/bin to root or may this cause some malfunctioning of other programs? Should they also have the "Set UID" option marked in the Privileges tab as sudo does?

Answer 1

Yes, all files under /usr should be owned by root, except that files under /usr/local may or may not be owned by root depending on site policies. It's normal for root to own files that only a system administrator is supposed to modify.

There are a few files that absolutely need to be owned by root or else your system won't work properly. These are setuid root executables, which run as root no matter who invoked them. Common setuid root binaries include su and sudo (programs to run another program as a different user, after authentication), sudoedit (a companion to sudo to edit files rather than run an arbitrary programs), and programs to modify user accounts (passwd, chsh, chfn).

In addition, a number of programs need to run with additional group privileges, and need to be owned by the appropriate group (and by the root user) and have the setgid bit set.

You can, and should, restore proper permissions from the package database. If you attempt to repair manually, you're bound to miss something and leave some hard-to-diagnose bugs lying around. Run the following commands:

rpm -qa | xargs rpm --setugids --setperms

Answer 2

Edit: See Gilles' answer for a way to fix the permissions and ownerships instead of trying to adjust based on my (for you probably incomplete) list.

There are a few files that are normally owned by another group. Excerpt from my system:

$ lsb_release -d
Description:    Debian GNU/Linux 6.0.9 (squeeze)

$ find /usr/bin -not -group root -exec ls -g {} \; | awk '{print $NF,$3}'
/usr/bin/crontab crontab
/usr/bin/mlocate mlocate
/usr/bin/mutt_dotlock mail
/usr/bin/expiry shadow
/usr/bin/mail-unlock mail
/usr/bin/wall tty
/usr/bin/mail-touchlock mail
/usr/bin/bsd-write tty
/usr/bin/screen utmp
/usr/bin/dotlockfile mail
/usr/bin/chage shadow
/usr/bin/ssh-agent ssh
/usr/bin/mail-lock mail

Files with SUID bit:

$ find /usr/bin -perm -4000
/usr/bin/newgrp
/usr/bin/sudoedit
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/gpasswd
/usr/bin/passwd
/usr/bin/sudo