Reset Permissions and Ownership Script

chownpermissions

On a development server (Ubuntu 14.04) we have this shell script running every minute on cron:

for dir in /home/*; do
  username=$(basename $dir)
  echo "changing ownership to $username in $dir/public_html"
  chown -R $username:$username $dir/public_html
  chmod 755 $dir
  chmod -R 775 $dir/public_html
done

Which has the aim of changing ownership and chmod of any file to the virtualhost's username. This is because when a new file is created, it's created by 'root' as our local machines are SMB to the server using root user. The files need to be owned by virtualhost username in order for them to run.

This script works perfectly well, BUT will start to slow down the server when we get a lot of virutalhosts / files as it chowns everything regardless of if it needs it. Most of the time it won't need it as it's only new files which do.

My thoughts are to change it to foreach public_html directory look for any files which are not owned by that virtualhost username and chown that only.

But I fear that having to roll through every file to know which ones to chown might be just as (or more) intensive than the way it works at the moment (just looking at directory level then running recursively).

So was wondering if anyone has a better idea for this? (happy with sh or php script solution)

Aim: any newly created file, chown and chmod it to virtualhost username and 755. Skip all other files. Would also be good to have ability to skip certain filetypes regardless.

Best Answer

"chown -R" will not change any file that already has the desired ownership. It will probably do the job more efficiently than writing a program that does it yourself. chown is written by some very good coders, who probably have taken into consideration a lot of edge cases that you may not have. However, the only way to know is via a benchmark. (I'd love to see your results!)

Here is a simple script that will safely find files not owned by mary, and set their ownership to mary:

find /home/the_place_to_start -xdev \! -user mary -print0 | xargs -0 chown mary

The "-xdev" means "don't cross mountpoints" and is a good safely mechanism. The "-print0" and "-0" options are to handle filenames with spaces and newlines in a secure way. This (and chmod -R) won't follow symlinks for security reasons... if someone made a symlink to / it would be very bad.

Also, if you are running a cron job every minute, it is often better to run the same code in a loop. Here is an explanation of why: http://everythingsysadmin.com/2014/02/how-not-to-use-cron.html

Related Topic