2

This is an actual work-related problem. Users could previously "su - userx" and was able to execute a script with user:owner permissions as userx:groupz 760 or 540, or modify a file that's userx:groupz 740 or 640. Now, that user may no longer su to userx and must perform tasks as a member of groupz. The group permissions need to be changed, but the problem files must be found first. They can be found when they fail, or hopefully you could help me find them proactively. Any file or directory whose owner:group is userx:groupz and whose group permissions are more restrictive than the owner permissions might be a problem and must be looked at in the context of "business logic". Is there a way to find all such files and directories? An answer to this could uncover many potential problems that would otherwise only surface when an operation that used to work now fails.

1

If you have GNU find available, you can use something like this:

find /somedir -user userx -group groupz \( -perm /u+w,g-w -o -perm /u+r,g-r -o -perm /u+x,g- \) -ls
  • jordanm, that looks great. I see the +- patterns. Based on that, did you accidentally leave of the x in -perm /u+x,g- expression (i.e. u+x,g-x)? – Tony V Dec 23 '15 at 0:36
  • That turned out to not be what I was looking for, but it led me in the write direction to find the solution which is as follows: – Tony V Dec 23 '15 at 2:56
  • ... as follows (showing only part of line): ( -perm -u=r -a ! -perm -g=r ) -o ( -perm -u=w -a ! -perm -g=w ) -o ( -perm -u=x -a ! -perm -g=x ) – Tony V Dec 23 '15 at 2:59
1

Look for files that belong to the desired user and group, and such that, for one of the three file access rights, the user has this right but not the group.

find / -user userx -group groupz \( -perm -u+r ! -perm -g+r -o \
                                    -perm -g+w ! -perm -g+w -o \
                                    -perm -g+x ! -perm -g+x \) -print

Note that this can return any file type, including symbolic links for which permissions and ownership don't matter on many unix variants. To exclude symbolic links, add ! -type l.

If you want to act on the files, use -exec.

If all you want to do is align group permissions on user permissions, you can run chmod g=u liberally.

find / -user userx -group groupz ! -type l -exec chmod g=u {} +
  • Thanks for the ! -type l and -exec suggestions. The 1st one solves a separate problem I was having yesterday! I use the -exec extensively but mostly with grep to search for files containing something. – Tony V Dec 23 '15 at 15:38
  • Does ! -follow work the same as ! -type l arguments? – Tony V Dec 23 '15 at 17:34
  • @TonyV No, -follow is global. (More precisely, it applies to any test that comes after it on the command line) It doesn't mean “follow this symbolic link”, it means “if you encounter a symbolic link, use its target”. It isn't a boolean test, so ! -follow doesn't make sense. – Gilles Dec 23 '15 at 17:39
0

Here is the final solution that I tested and it worked. In order to avoid searching on mounted remote file systems, I needed -mount, and to avoid following symbolic links I needed ! -follow. I wanted the output to show the permissions so I could easily verify they satisfied my criteria so I used -ls. A surprise was that "order of the arguments" was very important. Until I found an order that worked, the command would return some results that were incorrect.

find -user userx -group groupz -mount \ ( ( -perm -u=r -a ! -perm -g=r ) -o \ ( -perm -u=w -a ! -perm -g=w ) -o \ ( -perm -u=x -a ! -perm -g=x ) \ ) -ls ! -follow

  • The posted text wasn't exactly what I typed. Every left paren, (, and every right paren, ), must be preficed with a backslash, \. – Tony V Dec 24 '15 at 2:02
  • @Gilles - Hmmm. Thinking back to my toy problem test setup I only used -follow and also left -follow off. That makes sense. To not follow the link, just leave it off instead of negating it. Maybe the negate symbol made it do the same thing but regardless I think you'd suggest I leave off the "! -follow" and it would work. I agree. I used the above to solve my problem, but I'll try it again "in 2016" with my toy setup. Thanks! – Tony V Dec 24 '15 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.