For an application I support to work, various files and directories require certain ACLs to be in place. Unfortunately, occasionally security support scripts (not under my control) overwrite some of these permissions and my users' application starts to fail.
I have a script which sets the permissions, but it takes a long time to run and I was wondering if there was an easy way to do the equivalent of a 'dry run', showing whether anything would be changed if the set script were run. Since it is only reading ACLs, not attempting to write them, this should be much quicker. +
As an example, my set_facls script does things like:
setfacl -R -m g:staff:rwx,d:g:staff:rwx $APP_DIR/config/
Incidentally, I don't mind if other ACLs are set, I just want to verify that these particular ACLs are set as I need them.
I thought about trying to use setfacl --test but that seems to tell me what the permissions for every file and directory would be if I ran it, without filtering out ACLs which would remain the same. If setfacl had an option to list ACLs in the same form as setfacl --test lists them, I could diff their outputs, but even then that would probably be quite inefficient way of doing what I want.
+ On the filesystem I'm using, ACL reads appear to be much faster than writes. A find ... -ls on a test dir takes 0.6s, a setfacl takes 3.2s and interestingly the equivalent setfacl --test takes 2m8s!
