HPUX 11i - how to check for correct system file permissions

[Simon R Wootton]

Is there any utility which checks the correct permission settings for unix system files ? An incorrect 'chmod -R 777' command has been issued in the 'root' filesystem instead of one of the sub-filesystems by mistake on our system.

The command was running for approx 30 seconds before the error was spotted by the administrator. System seems OK, but nervous about a reboot.

Any help/pointers appreciated and rewarded!

Simon

[James R. Ferguson · Accepted solution]

Hi:

# swverify -F \*

...will fix all permissions and ownership along with checking the checksum of all installed products. By "installed", of course, I mean those installed with 'swinstall' and thus recorded in the Installed Product Database ('/var/adm/sw').

Regards!

...JRF...

[whiteknight]

Simon,

If there are many files with incorrect permissions, it is easiest to run
swverify(1M) with a wildcard that will check all the files on the system:

# swverify -v -x fix=true \*

For further information see the swverify man page:

fix=false If true, runs vendor-specific scripts to correct and
report problems on installed software. Fix scripts can
create missing directories, correct file modifications,
(mode, owner, group, major, minor), and recreate
symbolic links. If false, fix scripts are not run.

WK

[Bill Hassell]

Don't reboot!! Do not exit any window that has a current root login. Verify what commands you can still run as root (ie, su or sudo). Run the swverify command as mentioned. Hopefully, the system has not been damaged beyond repair.

The -R option in chmod and chown is the most dangerous option there is for system integrity. Note also that the command chmod -R 777 not only sets execute bits on files that should not have the bit set, it also opens every directory to massive mistakes where anyone an remove or rename files without any restrictions.

I have never seen a situation where 777 was the correct permission for a bunch of files.

[Steven E. Protter]

Shalom Simon,

Agree with Bill.
http://www.hpux.ws/?p=12

In there is a link to one of Bill's presentations that contains code for checking permissions. This will identify stuff missed by the swverify -F

SEP

[Doug Burton]

I would definitely check what has been said above.

The example below was for "/usr". You mention that "/" was affected. I would imagine it will take a nice long time for this to complete when done at the root level.

Restoring Default File Permissions/Ownership:

Somebody did a "chmod -R 777 /usr" for some reason. Now you need to restore all the files to whatever perms and ownership they originally had.

I assume your on the server in at least init level 2. Do this chmod so we can start fixing this mess.

/sbin/chmod ugo+rx /usr/bin/cut /usr/bin/expand /usr/bin/grep /usr/sbin/swlist

Then this:
comp="/usr"
(or this if there is more than one directory messed up)
comp=' -e ^/usr -e ^/var -e ^/sbin/init.d'

And away we go...

swlist -l file -a type -a path -a mode -a owner -a group | expand | grep \
$comp | cut -f 2 -d : | /sbin/awk '{if(length($2) < 2 && $4 > 0) \
print "/sbin/chmod "$4,$3";/sbin/chown " $5":"$6,$3}' | /sbin/sh

[Simon R Wootton]

Thankyou to everyone who posted.

After a nervous few hours, it appears that very few files were affected and the commands/advice given was excellent.

Thankyou again.

Sincerely,
Simon.