[Slackbuilds-users] template find/chmod RFC

[B. Watson]

RFC for new find/chmod in the SBo templates
===========================================

Please respond to this, if you have any opinion at all (for or
against the proposed change).

The existing template code:

----------------------------------------------------------------------
find -L . \
  \( -perm 777 -o -perm 775 -o -perm 750 -o -perm 711 -o -perm 555 \
   -o -perm 511 \) -exec chmod 755 {} \; -o \
  \( -perm 666 -o -perm 664 -o -perm 640 -o -perm 600 -o -perm 444 \
   -o -perm 440 -o -perm 400 \) -exec chmod 644 {} \;
----------------------------------------------------------------------

The proposed replacement code:

----------------------------------------------------------------------
find . ! -type l    -a \
   \(     -perm /111 -a ! -perm 755 -a -exec chmod -f 755 {} + \) -o \
   \(   ! -perm /111 -a ! -perm 644 -a -exec chmod -f 644 {} + \)
----------------------------------------------------------------------

English translation:

   For all files or dirs under the current directory:

     ...if it's a symlink, ignore it completely.

     ...if any of the +x bits are set (owner group other), but the mode
     is not already 755, set the mode to 755 (-rwxr-xr-x).

     ...else, if no +x bits are set, but the mode is not already 644,
     set the mode to 644 (-rw-r--r--).

     ...else, the mode was already 644 or 755, so don't change anything.

Explanation and notes:

Because of the + in the -exec, the filenames are all passed
as arguments to the same instance(s) of chmod, rather than
executing a separate chmod for each file. This is faster and less
resource-intensive: we only spawn 0, 1, or 2 chmod commands, no
matter how many files need changing.

We don't want to use -L (follow symlinks), because what if someone
creates a tarball with a symlink to /etc/shadow or /root? The
old template would 'chmod 644 /etc/shadow' or 'chmod 755 /root'!
Using "! -type l" omits symlinks entirely, which makes more sense
and is safer. Plus, symlinks' permissions aren't even used by the OS
(or changeable); the permissions of the symlink *target* are used.

The -f in the chmod command is probably redundant: it tells chmod
to always return success status, even if it failed to change the
permissions of one or more files. This is to avoid the script dying
due to "set -e". In my experience, chmod when run as root normally
only fails if it's passed a broken (dangling) symlink... which will
not happen here because of the "! -type l".

All the -a's are actually redundant: find assumes assumes -a (logical
AND) by default. I left them in because I think it's more readable
that way. Overall, I think this is more readable and easier to
understand than the old template.

This also is more reliable than the old template, which listed
explicit permissions (-perm 777 -o -perm 775 -o -perm 750, etc)
but the lists were incomplete. Files with mode 710, 510, 500, or 751
wouldn't get their permissions changed, for example.

I've been using this new find/chmod template for my own SlackBuilds
for about a year now, to test the waters, and I've had no problems.