How to verify directory/file permissions of every installed package? (warning: directory permissions differ)

General system Pacman & AUR helpers
1

Hello everyone,

I have made a post about my problem here, don’t want to copy everything over: https://discuss.cachyos.org/t/how-to-verify-directory-file-permissions-of-every-installed-package-warning-directory-permissions-differ/39043

The system in the post is an eos+alhp system, but since then I have checked my cachyos install too, same issues there too, so it’s not distro or repo specific.

Maybe someone here has some idea about solving this, seems like an issue that is at least not ideal or potentially a security issue if some critical file/directory is too permissive.

edit: link was wrong

2

Yes, well, I usually blame (whether true or not, i don’t know) lazy careless developers and packagers ;0
I’ll look forward to hearing what others think.

3

I think it’s not a maintainer issue, more like a pacman/knowledge issue. Everyone makes mistakes and they have fixed the permissions in an update since the first install. Probably that’s the cause of these mismatches.

Also pacman only warns about directory permissions, not file permissions.

I have no idea how to set everything to default. I rarely change permissions on system files.

4

There are a couple of common reasons for this:

  • The package permissions changed over time - Pacman won’t change the permissions of existing directory
  • The directory existed before the package was installed

Of course, it is also possible something else changed the directory permissions but this is less common.

If you want to check them, you can run pacman -Qkk which will verify everything. Be aware it will take a while to run.

5

In the meantime I have corrected the link.

Any idea how set them all back to default? tried with sudo pacrepairfile, but it doesn’t do anything.

6

You can simply run pacman -Qkk then fix the ones it reports. I would be surprised if it was a big list.

7

paccheck gave a really long list on both system even with different programs installed, but I’ll run it and will tell you how it went.

8

well there’s a lot of output, I have filtered for mismatch first, there were lot of lines about backup files, I don’t know what they mean and lot of kinds of mismatches, even file type!?

But I guess I only care about the permission ones, those are not that much, but it doesn’t tell me what it should be.

sudo pacman -Qkk 2>&1 | grep -i permission
c-ares: 189 total files,warning: cups: /etc/cups/classes.conf (Permissions mismatch)
warning: cups: /etc/cups/printers.conf (Permissions mismatch)
warning: cups: /etc/cups/subscriptions.conf (Permissions mismatch)
**fftw: 85 total files, 0 altwarning: filesystem: /root (Permissions mismatch)**
**hdparm: 16 total filwarning: ideapad2024-power-management: /etc/sudoers.d (Permissions mismatch)**
warning: libutempter: /usr/lib/utempter/utempter (Permissions mismatch)
warning: libvirt: /var/log/swtpm/libvirt/qemu (Permissions mismatch)
nfwarning: nordvpn-bin: /usr/lib/systemd/system/nordvpn.service (Permissions mismatch)
warning: openssl: /etc/ssl/private (Permissions mismatch)
warning: visual-studio-code-bin: /usr/share/code/resources/app/extensions/copilot/node_modules/@github/copilot/sdk/prebuilds/linux-x64 (Permissions mismatch)
warning: visual-studio-code-bin: /usr/share/code/resources/app/extensions/copilot/node_modules/@github/copilot/sdk/tgrep/bin/linux-x64 (Permissions mismatch)

paccheck does and it’s a lot faster

sudo paccheck --file-properties --quiet | grep -i permission
cups: '/etc/cups/classes.conf' permission mismatch (expected 644)
cups: '/etc/cups/printers.conf' permission mismatch (expected 644)
cups: '/etc/cups/subscriptions.conf' permission mismatch (expected 644)
**filesystem: '/root' permission mismatch (expected 750)**
**ideapad2024-power-management: '/etc/sudoers.d' permission mismatch (expected 755)**
libutempter: '/usr/lib/utempter/utempter' permission mismatch (expected 2711)
libvirt: '/var/log/swtpm/libvirt/qemu' permission mismatch (expected 755)
nordvpn-bin: '/usr/lib/systemd/system/nordvpn.service' permission mismatch (expected 664)
openssl: '/etc/ssl/private' permission mismatch (expected 700)
plymouth: '/usr/lib/plymouth/plymouth-update-initrd' permission mismatch (expected 755)
visual-studio-code-bin: '/usr/share/code/resources/app/extensions/copilot/node_modules/@github/copilot/sdk/prebuilds/linux-x64' permission mismatch (expected 775)
visual-studio-code-bin: '/usr/share/code/resources/app/extensions/copilot/node_modules/@github/copilot/sdk/tgrep/bin/linux-x64' permission mismatch (expected 775)

Same amount of lines about the same files/folders. I have highlighted 2 lines in each, don’t know how they exactly happened and what do they mean. Why does fftw care about /root and the ideapad one about sudoers.d, weird…

9

I’m also using the ALHP and did a check via the sudo pacman -Qkk command.

In the process I stumbled upon some identical file permission differences

Those should be only noise. The cups package installs them as 644, but cupsd rewrites these files in a stricter scope of 600.

It also varies on my machine with 2755, which isn’t that problematic I think. But could be enforced by reinstalling the package manually sudo pacman -S libutempter. Or by manually changing the permissions back via sudo chmod 2711 /usr/lib/utempter/utempter

But those are the only file permission difference I’ve seen on my system.

10

These look like they would be worth fixing or at least investigating.

11

cancel this answer…

12

From this it seems fftw package for some reason expects 750, but it’s already 750

drwxr-x--- 16 root root 4096 Oct 16 13:58 root

13

Your grep didn’t work properly here and prepended fftw: 85 total files, 0 alt in front of the warning for filesystem: '/root' (Permissions mismatch)