apply unix permission scheme on directory structure

Question

I like to fix permissions on our fileserver via cron. In general I like to set everything to umask 027 ignoring any changes a user did. For certain subfolders I like to apply umask 077.

The question is not about how to set and use umask, but correct repeatedly the permission via cronjob in case the user changed something.

eg in the end it should look like

drwx------ /home/user/.ssh
drwxr-x--- /hom/user/foobar
drwx------ /hom/user/Mail

The hard way (which I want to avaoid) looks like this:

chmod -R o-rwx /home/user  
chmod -R g+r /home/user  
find /home/user -typer d -exec chmod g+x '{}' \;  
chmod go-rwx /home/user/{Mail,.ssh}

Answer 1

Here's what we use for something similar (for all folders not owned by root). The seemingly unnecessary find commands are to ensure that we don't set permissions on any folder that was already set correctly. An earlier script that blindly chmod-ed all folders would cause some of my backups to think files had changed mid-backup, and I wasted a ton of media backing up the same files every day.

The resulting permission set:

• Home directories are mode 711 to prevent casual browsing, but still allow Apache to see into the user's public_html folder
• public_html is mode 755, as are all folders inside public_html except for a top-level private folder we use to store things that would otherwise be giant email attachments
• all files in public_html are mode 644

---

#!/bin/sh

cd /home/CAE
# For all directories except those owned by root
for user in `ls -l | grep -v ' root ' | egrep '^d' | awk '{print $NF}'`; do
    cd /home/CAE
    # Fix top-level permissions to avoid people browsing accounts, but
    # to allow normal Web access to public_html
    find . -mindepth 1 -maxdepth 1 -name ${user} -type d ! -perm 0711 -print0 |    xargs -r -0 chmod 711

    # Make sure user has a Web directory (and a private one, also)
    if [ ! -d ${user}/public_html/private ]; then
        mkdir -p ${user}/public_html/private
        chown -R ${user}:users ${user}/public_html
    fi

    cd ${user}/public_html

    # Set top-level private folder to mode 711 if it isn't already
    find . -mindepth 1 -maxdepth 1 -name private -type d ! -perm 0711 -print0 | xargs -r -0 chmod 711

    # Set all directories except top-level private to mode 755 that aren't already
    find . -maxdepth 1 -type d ! -name private ! -perm 0755 -print0 | xargs -r -0 chmod 755
    find . -mindepth 2 -type d ! -perm 0755 -print0 | xargs -r -0 chmod 755

    # Set all files mode 644 that aren't already
    find . -type f ! -perm 0644 -print0 | xargs -r -0 chmod 644

done

Answer 2

Forgive me if I'm missing the point, but it looks like you want a crontab entry that runs the following commands fairly frequently:

chmod -R go-rwx /home/user/.ssh
chmod -R g-w /home/user/foobar
chmod -R o-rwx /home/user/foobar
chmod -R go-rwx /home/user/Mail

or was that not what you were asking how to do?

Answer 3

You can mount the partition with acl support, and use the getfacl & setfacl commands to make & restore backups.