Calibrating permissions

[Jakob77]

Is there an elegant way to test and calibrate the MX permissions for user files and folders.?

I suspected ClipGrab to give some downloaded files the permission to run like programs but after a closer look I am not so sure ClipGrab is to blame.
The last five files I downloaded did not have the wrong permission but after I did a copy to an external USB solid drive they were changed so they all got permissions to run as programs.

Any ideas about how that can happen or if it is common.?

I have only discovered it by coincidence and I see nothing else wrong with the computer. In fact for me to see it has never run better.
Afterwards I tested a file copy from folder to folder on the internal drive, and that looks okay.
All copy jobs was done with Thunar.

A Terminal command that can set permissions correctly for all files (picture- and video clips) in a folder and all its sub folders can maybe do what is needed.?


QSI for the computer where I want to reset privileges:

Code: Select all

System:    Kernel: 5.10.0-25-amd64 [5.10.191-1] x86_64 bits: 64 compiler: gcc v: 10.2.1 
           parameters: BOOT_IMAGE=/boot/vmlinuz-5.10.0-25-amd64 root=UUID=<filter> ro quiet splash 
           Desktop: Xfce 4.18.1 tk: Gtk 3.24.24 info: xfce4-panel wm: xfwm 4.18.0 vt: 7 
           dm: LightDM 1.26.0 Distro: MX-21.3_x64 Wildflower January 15  2023 
           base: Debian GNU/Linux 11 (bullseye) 
Machine:   Type: Laptop System: Dell product: Latitude E7240 v: 01 serial: <filter> Chassis: 
           type: 9 serial: <filter> 
           Mobo: Dell model: 060GR9 v: A00 serial: <filter> BIOS: Dell v: A08 date: 02/18/2014 
Battery:   ID-1: BAT0 charge: 28.2 Wh (100.0%) condition: 28.2/45.0 Wh (62.7%) volts: 8.5 min: 7.6 
           model: LGC-LGC5.9 DELL J31N73B type: Li-poly serial: <filter> status: Full 
CPU:       Info: Dual Core model: Intel Core i5-4300U bits: 64 type: MT MCP arch: Haswell 
           family: 6 model-id: 45 (69) stepping: 1 microcode: 26 cache: L2: 3 MiB 
           flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx bogomips: 19954 
           Speed: 1191 MHz min/max: 800/2900 MHz Core speeds (MHz): 1: 1191 2: 1199 3: 1235 
           4: 1141 
           Vulnerabilities: Type: gather_data_sampling status: Not affected 
           Type: itlb_multihit status: KVM: VMX disabled 
           Type: l1tf mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable 
           Type: mds mitigation: Clear CPU buffers; SMT vulnerable 
           Type: meltdown mitigation: PTI 
           Type: mmio_stale_data status: Unknown: No mitigations 
           Type: retbleed status: Not affected 
           Type: spec_rstack_overflow status: Not affected 
           Type: spec_store_bypass 
           mitigation: Speculative Store Bypass disabled via prctl and seccomp 
           Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer sanitization 
           Type: spectre_v2 mitigation: Retpolines, IBPB: conditional, IBRS_FW, STIBP: 
           conditional, RSB filling, PBRSB-eIBRS: Not affected 
           Type: srbds mitigation: Microcode 
           Type: tsx_async_abort status: Not affected 
Graphics:  Device-1: Intel Haswell-ULT Integrated Graphics vendor: Dell driver: i915 v: kernel 
           bus-ID: 00:02.0 chip-ID: 8086:0a16 class-ID: 0300 
           Display: x11 server: X.Org 1.20.11 compositor: xfwm4 v: 4.18.0 driver: 
           loaded: modesetting unloaded: fbdev,vesa display-ID: :0.0 screens: 1 
           Screen-1: 0 s-res: 1920x1080 s-dpi: 96 s-size: 508x286mm (20.0x11.3") 
           s-diag: 583mm (23") 
           Monitor-1: DP-1-1 res: 1920x1080 hz: 60 dpi: 82 size: 597x336mm (23.5x13.2") 
           diag: 685mm (27") 
           OpenGL: renderer: Mesa DRI Intel HD Graphics 4400 (HSW GT2) v: 4.5 Mesa 20.3.5 
           compat-v: 3.0 direct render: Yes 
Audio:     Device-1: Intel Haswell-ULT HD Audio vendor: Dell driver: snd_hda_intel v: kernel 
           bus-ID: 00:03.0 chip-ID: 8086:0a0c class-ID: 0403 
           Device-2: Intel 8 Series HD Audio vendor: Dell driver: snd_hda_intel v: kernel 
           bus-ID: 00:1b.0 chip-ID: 8086:9c20 class-ID: 0403 
           Sound Server-1: ALSA v: k5.10.0-25-amd64 running: yes 
           Sound Server-2: PulseAudio v: 14.2 running: yes 
Network:   Device-1: Intel Ethernet I218-LM vendor: Dell driver: e1000e v: kernel port: f080 
           bus-ID: 00:19.0 chip-ID: 8086:155a class-ID: 0200 
           IF: eth0 state: down mac: <filter> 
           Device-2: Intel Wireless 7260 driver: iwlwifi v: kernel modules: wl port: f040 
           bus-ID: 02:00.0 chip-ID: 8086:08b1 class-ID: 0280 
           IF: wlan0 state: up mac: <filter> 
           IF-ID-1: wwan0 state: down mac: <filter> 
Bluetooth: Device-1: Intel Bluetooth wireless interface type: USB driver: btusb v: 0.8 
           bus-ID: 1-1.3:3 chip-ID: 8087:07dc class-ID: e001 
           Report: hciconfig ID: hci0 rfk-id: 5 state: up address: <filter> bt-v: 2.1 lmp-v: 4.0 
           sub-v: 500 hci-v: 4.0 rev: 500 
           Info: acl-mtu: 1021:5 sco-mtu: 96:5 link-policy: rswitch hold sniff 
           link-mode: slave accept service-classes: rendering, capturing, audio 
Drives:    Local Storage: total: 238.47 GiB used: 179.87 GiB (75.4%) 
           SMART Message: Unable to run smartctl. Root privileges required. 
           ID-1: /dev/sda maj-min: 8:0 vendor: Samsung model: SSD SM841 mSATA 256GB 
           size: 238.47 GiB block-size: physical: 512 B logical: 512 B speed: 6.0 Gb/s type: SSD 
           serial: <filter> rev: 3D0Q scheme: MBR 
Partition: ID-1: / raw-size: 230.47 GiB size: 225.79 GiB (97.97%) used: 179.87 GiB (79.7%) 
           fs: ext4 dev: /dev/sda1 maj-min: 8:1 
Swap:      Kernel: swappiness: 15 (default 60) cache-pressure: 100 (default) 
           ID-1: swap-1 type: partition size: 8 GiB used: 0 KiB (0.0%) priority: -2 dev: /dev/sda2 
           maj-min: 8:2 
Sensors:   System Temperatures: cpu: 52.0 C mobo: 43.0 C sodimm: SODIMM C 
           Fan Speeds (RPM): cpu: 3987 
Repos:     Packages: note: see --pkg apt: 2040 lib: 1031 flatpak: 0 
           No active apt repos in: /etc/apt/sources.list 
           Active apt repos in: /etc/apt/sources.list.d/debian-stable-updates.list 
           1: deb http://deb.debian.org/debian bullseye-updates main contrib non-free
           Active apt repos in: /etc/apt/sources.list.d/debian.list 
           1: deb http://deb.debian.org/debian bullseye main contrib non-free
           2: deb http://security.debian.org/debian-security bullseye-security main contrib non-free
           Active apt repos in: /etc/apt/sources.list.d/mx.list 
           1: deb http://mirrors.dotsrc.org/mx-packages/mx/repo/ bullseye main non-free
Info:      Processes: 201 Uptime: 3h 20m wakeups: 2 Memory: 7.67 GiB used: 1.55 GiB (20.2%) 
           Init: SysVinit v: 2.96 runlevel: 5 default: 5 tool: systemctl Compilers: gcc: N/A 
           alt: 10 Client: shell wrapper v: 5.1.4-release inxi: 3.3.06 
Boot Mode: BIOS (legacy, CSM, MBR)

[Eadwine Rose]

Select all, right click, properties, permissions.

[Charlie Brown]

...
A Terminal command that can set permissions correctly for all files (picture- and video clips) in a folder and all its sub folders can maybe do what is needed.?..

Just the -R flag (Recursive)

Code: Select all

sudo chown -R yourusername:yourusername /path/...

or first

Code: Select all

id

command and see your user id (generally it's 1000 for the 1st created user especially on Debian...) then , i.e. :

Code: Select all

sudo chown -R 1000:1000 /path/...

[Charlie Brown]

Oh, I noticed this just now:

... changed so they all got permissions to run as programs ...

Thunar (as mentioned above) is simpler, but in a terminal sudo chmod -x ... will remove that permission .

[towwire]

Is there an answer for this one?

The last five files I downloaded did not have the wrong permission but after I did a copy to an external USB solid drive they were changed so they all got permissions to run as programs.

Any ideas about how that can happen or if it is common.?

In post #3 @Charlie Brown answered the following.

A Terminal command that can set permissions correctly for all files (picture- and video clips) in a folder and all its sub folders can maybe do what is needed.?

[Jakob77]

Eadwine Rose

Yes, Thunar is very elegant for single files and a couple of folders.
That is also how I discovered it is a bit out of order. :-)





Charlie Brown

Thank you.
If the folder is ~/Music
And it has some different sub folders 'jazz', 'rock' etc.
Do you think this looks like a correct syntax that will take the permission to run as program away from all the files in one shot:

Code: Select all

sudo chmod -x -R ~/Music/*.*

[Charlie Brown]

...
And it has some different sub folders ... Do you think this looks like a correct syntax ...

Code: Select all

sudo chmod -x -R ~/Music/*.*

Yes, but no :D

If we do it in bulk, then, those which do not already have x (executable) may become problematic, new issues may occur.

Therefore, a safer way:

Normally it's

644 for files ( rw-r--r-- )

and

755 for directories ( drwxr-xr-x )


... So, you can first go to that folder (using the file manager) then "Open Terminal Here", then

Code: Select all

chmod 644 *

Just * instead of *.* because that one won't include the files with no extension. Or, you can of course do it as *.mp3 etc.


... But this time the sub-directories (just the sub-directory itself, not their contents) will also be 644 , you can chmod 755 foldername to turn them back to normal, one by one.

Yes, this will affect just the files and folders in that directory (not recursive) cause it may cause new issues, doing them one by one will be better.

[DukeComposed]

Normally it's

644 for files ( rw-r--r-- )

and

755 for directories ( drwxr-xr-x )

Normally in a situation like this, I'd invoke a find command to chmod the directories to 0755 (or whatever I choose) and another find command to chmod the files to 0644 (or whatever I choose). I also began wondering about the exact nature of calibrating file permissions, since UNIX admins usually just set them and forget them until something comes along to break those permissions. Then we set them again and forget them again.

So I checked the man page for find and discovered that, of course, someone's already thought about this problem and one can search for files with (or without) an exact permission mask.

So I tested this feature by creating a directory called test and two files with two different permissions, then running a find command to print the files that do not have a permission mode of 0644:

Code: Select all

mkdir test
cd test
ls

touch one.txt two.txt
chmod 0644 one.txt
chmod 0700 two.txt
find . -type f \! -perm 0644
./two.txt

Running find this way will be able to print out any and all files (or with "-type d", all directories) that do not have the permission mode given. This is a great way to check for files that do not have the correct permissions and they can be corrected individually, if needed.

[Jakob77]

Thank you very much.
I have to look more into the code before I ask more about it.
If I mess things up and create new issues when I with Thunar remove permission to run as a program on all files in a folder, then I am afraid I have already messed up before I asked here.




Can the reason for the problem be that the external SSD solid USB drive has been formatted by Windows 10 ?
I can't change the file permissions with Thunar on the USB drive, not even as root.
But after restoring on the target computer I can.

[FinalFox420]

Can the reason for the problem be that the external SSD solid USB drive has been formatted by Windows 10 ?
I can't change the file permissions with Thunar on the USB drive, not even as root.
But after restoring on the target computer I can.

You're very close to the answer.
This usuallly happens when the files were moved to a type of Filesystem that doesn't support the same permissions as ext4,FFS, etc.

This can be tested/reproduced by creating a file on your linux drive (which is probably ext4) and setting custom permissions, then moving it to a FAT32 formatted USB drive.
Like

Code: Select all

touch file
chmod 400 file
mv file /mnt/fatusb/
ls -al /mnt/fatusb/

and observe that the perms are different.

Reading the section 'Mount options for fat' in 'man mount' shows some useful options for this situation 'uid, gid, umask, dmask, fmask'.