[NTLUG:Discuss] Restore owners

[Greg Edwards]

> -----Original Message-----
> From: discuss-bounces at ntlug.org [mailto:discuss-bounces at ntlug.org] On
> Behalf Of Robert Citek
> 
> I suspect Greg is looking for a log file that looks similar to this:
> 
> $ find /etc/ | xargs stat -t | head -3
> /etc/ 12288 24 41ed 0 0 805 2473985 126 0 0 1204858989 1204858197
> 1204858197 4096
> /etc/aliases 52 8 81a4 0 0 805 2474515 1 0 0 1199403024 1199403024
> 1199403024 4096
> /etc/mime.types 20847 48 81a4 0 0 805 2474323 1 0 0 1204857215
> 1165428827 1199401813 4096
> 
> Greg would then be able to parse out the filename, uid, and gid
> (fields 1,5,6) and chown the files to their original configuration.
> 
> The question is, does RH keep such a log file and, if so, where?
> 
> Regards,
> - Robert
> 

Basically yes, and Tom's idea about /etc/permissions was one that I'd
forgotten about.  But no luck on either front.  No permissions file or
file with a snapshot of the ownerships and permissions like tripwire
would provide.

This is a RHEL 5.1 install with SELinux.  From what I've been able to
find, so far, it appears that RHEL does not perform any snapshot scans
of the FS.  If this was Mandriva I'd be able to pull the snapshot from
msec.

So far I haven't seen any issues, but I'm still holding my breath.  If
anyone has root access and a RHEL 5.0 or 5.1 install and can send me an
ls -lAR | grep -v "root root" listing from /usr/lib I'd be grateful.

Thanks,
--
Greg Edwards