Properly set execute bit based on file type?

Question

I'm trying to cleanup permissions on an Apache web server. I'm finding lots of files with the execute bit that don't customarily have it (or should not have it):

$ sudo find /var/www/html -executable -type f | grep '.png'
/var/www/html/.../jquery.ui/themes/smoothness/images/ui-icons_2e83ff_256x240.png
/var/www/html/.../jquery.ui/themes/smoothness/images/ui-bg_flat_0_aaaaaa_40x100.png
/var/www/html/.../jquery.ui/themes/smoothness/images/ui-icons_cd0a0a_256x240.png
...

How can I set the execute bit for regular files that customarily have it (like programs, PHP pages and Bash scripts); and remove it from regular files that customarily don't have it (like TXT, PNG, JPG and ZIP files)?

I feel like find with an -exec and chmod should come into play somewhere. I also expect the selection mechanism will take into account shebangs and other magic headers; and not just rely on an [potentially incorrect] execute bit or a [potentially missing] extension. But my searching is not landing on the right answer. Cf., How can I find only the executable files under a certain directory in Linux? and Find executable files recursively.

Answer 1

This will go through your files and set the executable bit according to whether file believes that the file should be executable:

find /var/www/html -type f -exec bash -c 'if file -b "$1" | grep -q executable; then chmod +x "$1"; else chmod -x "$1"; fi' None {} \;

The find command is very similar to yours. The change is the addition of the bash commands. It may be simpler to understand them if they are spread out over multiple lines like this:

if file -b "$1" | grep -q executable
then
    chmod +x "$1"
else
    chmod -x "$1"
fi

You may, of course, modify the chmod argument to meet your specific needs.

Answer 2

I don't now what is your use case, but I rarely have executable files under my web folder. And on production machines I also remove write permission to most of the files.

For spacial cases i keep a separate file which include all the specific cases, like which folders need writing permission or a different owner, And use it to overwrite the defaults.

find /path/to/webroot/ -type f -exec chmod 644 -c '{}' \;
find /path/to/webroot/ -type d -exec chmod 755 -c '{}' \;
# change owner 
chmod root:www-data /path/to/webroot/ -R

bash .fix-perm

where .fix-perm is just a script file

#.fix-perm
chmod g+w cache -R
chmod g+w logs -R