verify ownership on all files and directories associated with packages

Question

In the Redhat, we can verify ownership on all files and directories associated with packages by using the following command:

# rpm -Va | grep '^......U'

Is there any equivalent command for Ubuntu? I know that debsums is equivalent to rpm -Va, but I don't understand meaning of grep '^......U'.

Answer 1

If the deb package is still beneath /var/cache/apt/archives/, then you can use dpkg -c <packagename> to list the contents of the package. Example output for package apt-file_2.5.1_all.deb (I'm on a Debian system right now):

drwxr-xr-x root/root         0 2012-06-03 10:32 ./
drwxr-xr-x root/root         0 2012-06-03 10:32 ./etc/
drwxr-xr-x root/root         0 2012-06-03 10:32 ./etc/apt/
-rw-r--r-- root/root      2144 2012-06-03 10:32 ./etc/apt/apt-file.conf
drwxr-xr-x root/root         0 2012-06-03 10:32 ./etc/bash_completion.d/
-rw-r--r-- root/root       748 2012-06-03 10:32 ./etc/bash_completion.d/apt-file
drwxr-xr-x root/root         0 2012-06-03 10:32 ./usr/
drwxr-xr-x root/root         0 2012-06-03 10:32 ./usr/bin/
-rwxr-xr-x root/root     10584 2012-06-03 10:32 ./usr/bin/diffindex-download
-rwxr-xr-x root/root      8762 2012-06-03 10:32 ./usr/bin/diffindex-rred
-rwxr-xr-x root/root     23919 2012-06-03 10:32 ./usr/bin/apt-file
-rwxr-xr-x root/root      6437 2012-06-03 10:32 ./usr/bin/rapt-file
drwxr-xr-x root/root         0 2012-06-03 10:32 ./usr/share/
drwxr-xr-x root/root         0 2012-06-03 10:32 ./usr/share/apt-file/
-rw-r--r-- root/root       558 2012-06-03 10:32 ./usr/share/apt-file/apt-file-update.update-notifier
-rwxr-xr-x root/root        98 2012-06-03 10:32 ./usr/share/apt-file/do-apt-file-update
-rwxr-xr-x root/root       370 2012-06-03 10:32 ./usr/share/apt-file/is-cache-empty
drwxr-xr-x root/root         0 2012-06-03 10:32 ./usr/share/man/
drwxr-xr-x root/root         0 2012-06-03 10:32 ./usr/share/man/man1/
-rw-r--r-- root/root      2628 2012-06-03 10:32 ./usr/share/man/man1/apt-file.1.gz
-rw-r--r-- root/root       905 2012-06-03 10:32 ./usr/share/man/man1/diffindex-download.1.gz
-rw-r--r-- root/root       646 2012-06-03 10:32 ./usr/share/man/man1/diffindex-rred.1.gz
-rw-r--r-- root/root      1023 2012-06-03 10:32 ./usr/share/man/man1/rapt-file.1.gz
drwxr-xr-x root/root         0 2012-06-03 10:32 ./usr/share/doc/
drwxr-xr-x root/root         0 2012-06-03 10:32 ./usr/share/doc/apt-file/
-rw-r--r-- root/root       401 2012-06-02 18:50 ./usr/share/doc/apt-file/README
-rw-r--r-- root/root       464 2012-06-02 18:50 ./usr/share/doc/apt-file/copyright
-rw-r--r-- root/root      8634 2012-06-03 10:28 ./usr/share/doc/apt-file/changelog.gz
drwxr-xr-x root/root         0 2012-06-03 10:32 ./var/
drwxr-xr-x root/root         0 2012-06-03 10:32 ./var/cache/
drwxr-xr-x root/root         0 2012-06-03 10:32 ./var/cache/apt/
drwxr-xr-x root/root         0 2012-06-03 10:32 ./var/cache/apt/apt-file/

You can now check the permissions and set them accordingly.

This site has a script (printed below) that you could use to re-set the permissions according to the packages present on your system.
To limit the scope of the script to a single .deb package, copy the package in question from /var/cache/apt/archives/ to another folder and put that folder in the ARCHIVE_DIR variable of the script.

#!/bin/bash
# Restores file permissions for all files on a debian system for which .deb
# packages exist.
#
# Author: Larry Kagan <me at larrykagan dot com>
# Since 2007-02-20
ARCHIVE_DIR=/var/cache/apt/archives/
PACKAGES=`ls $ARCHIVE_DIR`
cd /
function changePerms()
{
CHOWN="/bin/chown"
CHMOD="/bin/chmod"
PERMS=`echo $1 | sed -e 's/--x/1/g' -e 's/-w-/2/g' -e 's/-wx/3/g' -e 's/r--/4/g' -e 's/r-x/5/g' -e 's/rw-/6/g' -e 's/rwx/7/g' -e 's/---/0/g'`
PERMS=`echo ${PERMS:1}`
OWN=`echo $2 | /usr/bin/tr '/' '.'`
PATHNAME=$3
PATHNAME=`echo ${PATHNAME:1}`
echo -e "CHOWN: $CHOWN $OWN $PATHNAME"
result=`$CHOWN $OWN $PATHNAME`
if [ $? -ne 0 ]; then
echo -e $result
fi
echo -e "CHMOD: $CHMOD $PERMS $PATHNAME"
result=`$CHMOD $PERMS $PATHNAME`
if [ $? -ne 0 ]; then
echo -e $result
fi
}
for PACKAGE in $PACKAGES;
do
if [ -d $PACKAGE ]; then
continue;
fi
echo -e "Getting information for $PACKAGE\n"
FILES=`/usr/bin/dpkg -c "${ARCHIVE_DIR}${PACKAGE}"`
for FILE in "$FILES";
do
echo "$FILE" | awk '{print $1"\t"$2"\t"$6}' | while read line;
do
changePerms $line
done
done
done

Answer 2

From man rpm:

The format of the output is a string of 8 characters, a possible "c" denoting a configuration file, and then the file name. Each of the 8 characters denotes the result of a comparison of attribute(s) of the file to the value of those attribute(s) recorded in the database. A single "." (period) means the test passed, while a single "?" indicates the test could not be performed (e.g. file permissions prevent reading). Otherwise, the (mnemonically emBoldened) character denotes failure of the corresponding --verify test:

S file Size differs
...
U User ownership differs

U in the sixth column of output indicates that the user ownership has changed (hence the five . in your grep).

I couldn't find anything similar in debsums or the various dpkg utilities.

I wonder if this is even possible with Debian packaging, since:

1. No matter who owned the files when creating the package, for installation they are owned by root:root. Only the modes remain intact.
2. Ownership is set using a chmod in the postinst script (e.g., nslcd).

The only way to do this would be using some sort of IDS, such as AIDE or OSSEC.