I'm not sure. I'm not doing anything at the moment, just thinking out aloud.
- I've answered a few questions on "chmod/chown-gone-wild" questions and I usually lean towards reinstallation. It's faster and safer.
- But I'm normally talking about system-wide changes.
- It's
/var/
that is most complex.
- Most other directories are a much more simple
root:
pattern until you get to /home
But even in /usr/
, there are outliers:
$ sudo find /usr/ -not \( -user 0 -group 0 \) -not -path "/usr/*/node_modules/*" -not -path "/usr/local/lib/python*" -printf "%p,%u:%g\n" | grep -viE "(squeeze|rabbitmq|nginx|lxc|postfix)" | sort -u | column -t -c 80 -s ,
/usr/bin/AfterShot3X64 oli:oli
/usr/bin/bsd-write root:tty
/usr/bin/chage root:shadow
/usr/bin/crontab root:crontab
/usr/bin/dotlockfile root:mail
/usr/bin/expiry root:shadow
/usr/bin/mlocate root:mlocate
/usr/bin/smerge 501:staff
/usr/bin/ssh-agent root:ssh
/usr/bin/wall root:tty
/usr/lib/dbus-1.0/dbus-daemon-launch-helper root:messagebus
/usr/lib/evolution/camel-lock-helper-1.2 root:mail
/usr/lib/libvte9/gnome-pty-helper root:utmp
/usr/lib/x86_64-linux-gnu/utempter/utempter root:utmp
/usr/local/share/emacs root:staff
/usr/local/share/emacs/site-lisp root:staff
/usr/local/share/fonts root:staff
/usr/local/share/sgml/declaration root:staff
/usr/local/share/sgml/dtd root:staff
/usr/local/share/sgml/entities root:staff
/usr/local/share/sgml/misc root:staff
/usr/local/share/sgml root:staff
/usr/local/share/sgml/stylesheet root:staff
/usr/local/share/texmf root:staff
/usr/local/share/xml/declaration root:staff
/usr/local/share/xml/entities root:staff
/usr/local/share/xml/misc root:staff
/usr/local/share/xml root:staff
/usr/local/share/xml/schema root:staff
/usr/sbin/postdrop root:postdrop
/usr/sbin/postqueue root:postdrop
/usr/sbin/pppd root:dip
/usr/share/applications/AfterShot3X64.desktop oli:oli
/usr/share/applications/sublime_merge.desktop 501:staff
/usr/share/icons/hicolor/128x128/apps/sublime-merge.png 501:staff
/usr/share/icons/hicolor/16x16/apps/sublime-merge.png 501:staff
/usr/share/icons/hicolor/256x256/apps/sublime-merge.png 501:staff
/usr/share/icons/hicolor/32x32/apps/sublime-merge.png 501:staff
/usr/share/icons/hicolor/48x48/apps/sublime-merge.png 501:staff
/usr/share/mime/packages/AfterShot3X64.xml oli:oli
/usr/share/pixmaps/AfterShot3X64.png oli:oli
/usr/share/ppd/custom root:lpadmin
Some of this is common some is crank from my computer. Note I excluded node_modules (which was appalling) and similarly python (abused by sudo pip3
over the years). These were thousands of files owned by $USER.
So what next?
I'm not sure. Is that answer good enough that our collective advice to people changes from You Done Messed Up A-Aron! to You can fix it?
I can't speak for this user's system before the incident, but whenever people deliberately start tearing down walls in the permissions, I worry about the other things they've done to get where they are.
I'd personally probably still recommend backup and reinstall.