Tag Info

Hot answers tagged

31

Because an evil user can maliciously try to point the file root is writing to a different location. This is not so simple, but really possible. As an example, if a user would find the way to make a symlink from the supposed Apache log to, say, /etc/shadow you'll suddenly have an unusable system. Apache (root) would overwrite your users' credentials making ...


13

You need to change the permissions of the mounted filesystem, not of the mount point when the filesystem is not mounted. So mount /var/lib/mysql then chown mysql.mysql /var/lib/mysql. This will change the permissions of the root of the MySQL DB filesystem. The basic idea is that the filesystem holding the DB needs to be changed, not the mount point, unless ...


8

I've seen something similar to this. What ended up being the case is that the file was deleted while there were still outstanding locks on it. I couldn't do a darned thing to it. Clearing the outstanding locks caused the file to fully delete.


7

"Just reinstall and be happy it wasn't a production machine?" Yes.


7

Use the native tools. Right click on the folder and select properties. Select the Security Tab Click the Advanced button. Select the Owner Tab. Click Edit. Select who to change the ownership to. Click OK through all the Windows


6

I have to give Kyle Brandt complete credit above. So, if you like this answer below, click the Up triangle on his post to lift his status, please. However, I improved upon his routine and felt it my duty to post it here and mark it as the final answer. All I added to Kyle's routine was ensure that we're only touching the home dir, thus the line with the ...


6

You can dump the attributes of the files using getfacl -R * >perms.bak and recover them using setfacl --restore=perms.bak


5

I think the way you are asking is kind of backwards. You don't want to take each folder and then find the user, rather you want to take the user and find their home folder. #!/bin/bash while IFS=':' read -r login pass uid gid uname homedir comment; do echo chown $uid:$gid "$homedir"; done < /etc/passwd You will need to remove the echo of course ...


5

#!/bin/bash for f in $( ls /home/ ); do chown -R $f:yourgroup /home/$f done There is no sanity checking in this and I wrote it without any testing, so be careful. (BTW, the requirement of "no hidden files or folders" will be met by the fact that a hidden file in Unix is just a regular file with a . before it, and .username will not be a valid user for ...


5

Add uid and gid like these: /dev/mapper/db-db /var/lib/mysql ext3 realtime,rw,exec,uid=frank,gid=www-group 0 2 You can use actual user/groupnames (beware of spaces) or numeric uid, gid values. I added rw and exec which might further help you prevent access troubles (presuming you are on a development system, not a production server). PS: I ...


5

Generally speaking, a web server's user should not have write access to anything, particularly not if it is running dynamic systems like PHP. Apache achieves privilege separation by having the sensitive bits operate from a master process running as root, which the children can send log events to and get configuration from. The children run as unpriviliged ...


5

There is the --numeric-owner switch that gives the information that you want tar --numeric-owner -tvf example.tar --numeric-owner always use numbers for user/group names


5

You just need to set the group ownership and then set the group setgid bit on the parent directory. $ chgrp -R mygroup /path/to/mydir $ chmod g+s /path/to/mydir


5

Assuming a Unix-like Operating System, running processes will not pick up the new secondary group. To pick up the new group membership a new login will be required. If you are starting / stopping Oracle as root via scripts, that is probably sufficient. If you are logged in as the Oracle user, then you will have to log out and back in again. In general, ...


4

I believe ALTER_AUTHORIZATION and sp_changedbowner can both change ownership of the database object. The difference between the commands, of course, is that ALTER_AUTHORIZATION can change other things (like the ownership of tables), whereas sp_changedbowner is just for changing the owner of the database. The behavior you indicated sounds very strange, ...


4

It is to protect the user from making a mistake. If the file is important and should not be modified you give read only. Then if the user needs to change it they will have to make a conscious choice to go and chmod 777 the file and then do the action. Also not letting things be executable helps. If you are writting a script and have several older version ...


4

I'd run CHKDSK on the volume before I did anything else. Are you seeing any messages in the System Event Log re: filesystem corruption (source "NTFS")?


4

My first suggestion would be to set up a more traditional backup system -- Bacula, tar, or even boring old dump(8) & restore(8) -- and store those backups to the squashed NFS store. You can still use rsnapshot locally as a "quick recovery" kind of tool. The big benefit here is a well-known, well-supported way of doing your backups that's easier to ...


4

"we do have a policy allowing personal use of computers, subject to a number of restrictions of course." Have a meeting with the requester, your boss, HR, and Legal (if you have it.) That would be my response, especially in light of the fact that you have a policy allowing users to do this.


4

If the data stored on the company computers, then it is company data unless the company policies specifically says that the employee can store data on the machines which the company won't be looking at. This is probably going to end up being one of those things that you have to do, even if you don't like it.


4

Yes, domain members do cache SIDs that they perform lookups on. Yes, you can reconfigure the timeouts. Try HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LsaLookupCacheRefreshTime for instance. There are additional related registry values in the TechNet article I'll link to at the end. Keep in mind that by reducing this caching, you're increasing ...


3

This might help #!/bin/bash for file in `ls -a | grep -v '^\.'` do if [[ -d $file ]] then fowner=`ls -ld $file | nawk '{print $3}'` fgroup=`ls -ld $file | nawk '{print $4}'` chown -R $fowner:$fgroup $file fi done


3

Would the SUID and SGID bits help you? I use a similar mechanism to allow members of the bzr group to commit files to a bazaar central repo and still keep the accessible permissions. drwsrwsr-x 3 bzr bzr 4.0K 2010-04-15 17:58 bzr set with sudo chmod ug+s /home/bzr /etc/group contains bzr:x:1012:bzr,tom,<and a whole bunch of other ...


3

same thing happened to me. restart fixed it!


3

2016 is a uid. Every user account has a name (like root) and a uid. Normally the uid is only shown if there is no matching user account. This can happen if the file was previously owned by a valid user, but later that user was deleted. The file’s owner wasn’t changed, so now the file is owned by a non-existent uid. You probably want to assign ownership of ...


3

Typically on a multi-user system you would simply set the directory executable and leave all files within the directory public readable. If you run the server yourself, you will have the ability to set the group to the same group as the Apache group and set the directory group writable. Additionally, you would want to SGID, so as that anything created ...


3

Ended up achieving what I wanted with Setacl. I wrote the following script which ripped through the entire folder structure and files, and gave ownership to the local Administrators group, then went through again and added a full control ACE for our IT domain group. It did this without replacing or removing the existing permissions/ACEs (other than replacing ...


3

You can use sticky bit on directory which affects ownership of newly created files and directories. And combine with umask, which will create new files with certain permissions. Update after comment: Group sticky bit on directory will overwrite group ownership of newly created files within this directory no matter in which group is user who creates this ...



Only top voted, non community-wiki answers of a minimum length are eligible