TechNote: Restoring Original Package File Permissions

In the event of drastic file permission or ownership changes, it is possible to restore the original permissions of the file(s). Solaris maintains a database of all packages installed on a system, and the files included with these packages. Sun has taken to calling this database the Solaris Software Registry. Most administrators will recognize it as the /var/sadm directory hierarchy.

Each time a file is installed on a Solaris system through a package, an entry is added to the /var/sadm/install/contents file. These entries contain several pieces of information on a file, including its path, owner, permissions, etc. This information can be used to restore permissions and ownerships which have been accidentally changed.

The example presented below represents a dramatic example--perhaps an administrator issued the command chown -R someuser /. This would cause the entire contents of the filesystem to be owned by someuser. One byproduct of this command is that setuid files, such as /usr/bin/login would cease to function.

Important Note: The pkgchk command does not restore setuid, setgid, and sticky bits. These must be set manually.

To restore the file permissions, do the following:

Boot the system from alternate media, such as a CD-ROM, in single-user mode.

ok boot cdrom -s 

# mount / /a
# mount /usr /a/usr
# mount /var/ /a/var
# mount /opt /a/opt

pkgchk -R /a -f

For more information, please refer to the series of articles recently published on Sun Blueprints Online about the Solaris Software Registry, one of which describes using the pkgchk command in more detail.