34

I'd like to compress some files for http distribution, but found that .tar.gz keeps the user name and user ID and there doesn't seem to be any way to not do that? (There is a --numeric-owner option for tar which seems to ignore the user name, but still keeps the user ID.)

Doesn't that mean that .tar.gz is a poor choice for file distribution as my system probably is the only one with my user ID and my user name? Is .7z a better format for file distribution, or do you have any other recommendation?

3
  • This is not a duplicate question of unix.stackexchange.com/questions/281591/… Commented Feb 7, 2022 at 15:24
  • That topic asks how to change the owner and permissions when extracting a tarball, here instead simply asks not to preserve the owner and permissions of an archive, so the owner and permissions of the extracted files will be dependent on the user who extracts them. Commented Feb 7, 2022 at 15:31
  • The perfect answer is: tar () { command tar "$@" --no-same-owner --no-same-permissions; return $?; } Commented Feb 7, 2022 at 15:36

5 Answers 5

29

Generally .tar.gz is a usable file distribution format. GNU tar allows you not to preserve the owner and permissions.

$ tar -c -f archive.tar --owner=0 --group=0 --no-same-owner --no-same-permissions .

https://www.gnu.org/software/tar/manual/html_section/tar_33.html#SEC69

If your version of tar does not support the GNU options you can copy your source files to another directory tree and update group and ownership there, prior to creating your tar.gz file for distribution.

--owner=0 and --group=0 works only in compression phase of the file while in decompression phase it has no effect.
--no-same-owner --no-same-permissions works only in decompression phase while in compression phase it has no effect.
Put together they can constitute a default function in which tar assumes the characteristics of not remembering the user who compressed or decompressed the files.
When during compression the files are stored with user and group 0, during the decompression via GUI, they assume the permissions of the user who extracts the files, so it is a valid solution to forget the user in the compression phase.

5
  • 7
    So setting root user ID is what people normally do? Commented May 24, 2016 at 20:04
  • 1
    From man: There is no value indicating a missing number, and "0" usually means root. Some people like to force "0" as the value to offer in their distributions for the owner of files, because the root user is anonymous anyway, so that might as well be the owner of anonymous archives.
    – mvorisek
    Commented Aug 17, 2018 at 7:37
  • 1
    --same-owner is another flag to look for
    – Vishrant
    Commented Jan 22, 2019 at 20:29
  • It seems like the manual link has died, the section referenced in this answer (4.3.1 Overriding File Metadata) has moved to here
    – jrh
    Commented Jun 10, 2021 at 19:38
  • On macOS the command line options are --uid 0 and --gid 0.
    – Utkonos
    Commented Mar 9, 2023 at 14:41
6

You're looking for something like tar --owner=0 --group=0 to set everything owned by root/root.

2
  • how to do that while untar
    – CS QGB
    Commented May 7, 2023 at 16:32
  • @CSQGB Type man tar and look at the --no-same-owner --no-same-permissions help descriptions. The --no-same-owner is the only relevant flag, but the permissions flag is also useful if you want to use default file/folder permissions (as if fresh files). Oh and also, the advice to force --owner=0 --group=0 is kinda useless, except if you REALLY want to hide the original owner's name/group metadata when creating the archive, but beware that those flags will create archives with root-owned files. If you only care about extraction, just use the --no-same-* flags when extracting. Commented May 8, 2023 at 7:07
6

With GNU you can use --numeric-owner to prevent tar from storing your username. Alternatively, you can set another userid with --owner=ID. When it's extracted, those user ids will be dropped, unless the extractor is the root user.

A common way used to bundle files is cpio which is typically used with the --no-preserve-owner option. This is how rpm files are built.

But tar with user-ids is rarely an issue. If you want to be paranoid, you use a dedicated account for the final bundling.

4

Any existing tarballs can be sanitized via something like:

#!/usr/bin/env perl
use strict;
use warnings;
use Archive::Tar 1.80;

for my $tarfile (@ARGV) {
    my $tar = Archive::Tar->new($tarfile) // die "failed to read '$tarfile'\n";
    for my $archivefile ($tar->list_files) {
        $tar->chown($archivefile, 'root:root');
    }
    my @compression;
    if ($tarfile =~ m/gz$/) {
        @compression = COMPRESS_GZIP;
    } elsif ($tarfile =~ m/bz$/) {
        @compression = COMPRESS_BZIP;
    }
    $tar->write($tarfile, @compression);
}
1
  • Does this perl module support modern tar archive formats?
    – schily
    Commented May 24, 2016 at 20:50
3

You can fool tar into treating the files as if they have a different owner with fakeroot.

Fakeroot runs a command in an environment were it appears to have root privileges for file manipulation, by setting LD_PRELOAD to a library with alternative versions of getuid(), stat(), etc. This is useful for allowing users to create archives (tar, ar, .deb .rpm etc.) with files in them with root permissions/ownership.

Initially, all files will appear to be owned by root, but you can chown them from inside the fakeroot shell, and subsequent commands will see the new owner.

Not the answer you're looking for? Browse other questions tagged .