nautilus/nemo/other file manager - suggestions for more accessible GUI-based owner management?

Question

Short version

TL;DR - When running nemo/nautilus with elevated privileges*, there are a TON of users/groups on the permissions tab... they're all jammed in non-searchable drop-downs that don't have any hotkey support. Looking for tweaks/alternate file managers/chmod gui-wrappers so I can change ownership from GUI without the accessibility nightmares. Any suggestions?

---

More Info

I have several versions of Ubuntu 18.04 installed in Virtualbox. I have primarily been using Cinnamon desktop/nemo up to this point.

Mostly, I am extremely happy with this desktop. But GUI-based ownership changes (from root) are frustrating because a TON of entries are jammed into a drop-down that I can't search and can't use hotkeys from (e.g. to press r to jump to "root", etc). Launching terminal is reliable but slow to type out names when I'm in a hurry.

Note: That this isn't really an issue when running the file manager from non-root accounts as the owner is not editable and only a few groups are displayed.

I generally run into this I am trying to fix botched ownership perms on shared folders that the current user doesn't own. And it's generally never as quick and easy as running a single chown -R command.

I have encountered this same accessibility design in:

• nemo v.3.6.5 (ubuntu 18.04/gnome+cinnnamon)
• nemo v4.2.3 (in a popular sub-distro that I'm apparently no longer allowed to mention here)
• nautilus v3.26.4 (ubuntu 18.04/gnome).

---

Criteria:

I am interested in finding a GUI-based solution that meets these criteria:

• Works on some flavor of Ubuntu 18.04 / bionic (bc I prefer LTS editions)
• Decent user accessibility for lists of 50-100 users/groups (e.g. at least attempts to deal with non-trivial list size such as by having hotkey support, search filters, option to hide service accounts, or something else)
• No issues running under root (e.g. via pkexec or whatever). Only mentioning this because I've run across a handful of apps before that flat-out refuse to run under root.

At this point, I'm just hoping somebody knows of an option that I don't... I don't particularly care if this is a nemo-specific tweak, a system configuration, some obscure build option, a different file manager/desktop environment, some external app that wraps a GUI around chown (as long as I can throw it in a nemo-action and pass it the path), etc. Mostly just looking to avoid the extra runaround of launching terminal and typing out longer names by hand when I'm in a hurry.

* Also, when I say I am "running as root" / "running with elevated privileges", I mean the option that appears in the nemo/nautilus UI rather than me launching directly with sudo / pkexec / etc.

---

Steps to view dialog issue:

1. Create a folder named "test" on desktop or wherever that is owned by non-root account
2. In Nemo, right-click > "Open as root" > enter password. Or for nautilus, run pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY nautilus to open with admin privileges.
3. With the admin instance, right-click on the "test" folder > Properties > Permissions tab
4. Observe that ALL the service accounts and groups are displayed with no means to filter them / no checkbox to hide them. Observe that pressing "R" in the drop-down does NOT jump to or select "root" (or whatever the first account starting with "R" is). In my case, there's something like 50 users displayed (3 of which are non-service accounts) and something like 80 groups displayed (8 of which are not related to service accounts). For me, this is an accessibility nightmare and it makes searching things out almost as painful as needing to launch the terminal and type it out by hand.

---

What I've tried:

I'll follow-up if I find discover anything that works but so far, I have tried the following:

• Permit was almost exactly what I am looking for except that it appears to require typing out the names instead of picking from a list/drop-down/etc. Unfortunately, I have absolutely zero GTK skills at the moment (although I might revisit this when I have more time if nobody has better suggestions).
• Ubuntu 18.04.2/gnome - Couldn't figure out how to run as root initially but pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY nautilus eventually worked. Not surprisingly, this seems to have the same issue as nemo.
• Ubuntu 18.04.2/cinnamon - after installing cinnamon and running nemo as mentioned above, this doesn't do what I am looking for.
• Kubuntu 18.04 - Couldn't find a way to launch dolphin as root so not able to test. User/Group fields were grayed out for me when running as the default non-root account on livedisc. Sounds like this is an issue with v17 and I'd have to get v18 to even have a chance at running as root.
• UPDATE 1: Found this site mentioning Eiciel. Tried it out with sudo apt install -y eiciel and touch /tmp/foo.txt && eiciel /tmp/foo.txt ... seems pretty cool but unfortunately, either it doesn't allow changing owners or I'm just not getting how to do it (seems to add users/groups to ACL rather than replacing current owner/group).
• UPDATE 2: tested thunar on an ubuntu 18.04-based sub-distro. When I ran it with sudo thunar / and went to the permissions tab, the group drop-down had the same issue that nemo/nautilus have and it wouldn't even let me edit the user at all despite running as root.
• UPDATE 3: tested with krusader in kubuntu. running as root, on the permissions dialog, the owner/owning group fields are just text input fields (e.g. you have to type it out).

---

Screenshot

The non-searchable drop-down with lots of entries and no hotkey support that appears in (admin/root/pkexec) nemo and nautilus > properties > Permissions tab.

Answer 1

UPDATE: Haven't heard any other responses and this has been working a lot better since I updated it to add multi-selection support so I guess, lacking any other options, I'll accept this as my answer

UPDATE #2: I have since created a script that does all the heavy lifting and automates the steps below for you. You can find more info on the script in my github.

---

I'm still very interested in other answers but I have at least found a somewhat hackish workaround (bash + yad + pkexec) which I consider to be better than nothing... also went ahead and submitted it as a feature request in the nemo project, so hopefully one of those guys can figure out something better than what I have here.

Assumptions

My workaround assumes the following:

• You have yad installed: sudo apt install -y yad
• You don't mind editing the user/group in a separate dialog (e.g. chmod stuff is not handled at all; only chown)
• You don't mind doing some legwork for the initial setup
• You are ok with my very unsophisticated user/group selection.
• You are ok with the drop-down not supporting keypresses / autocomplete.
• The policykit stuff makes it so that non-root nemo gets an auth prompt (every time) but root nemo never gets prompted. You can always change the policykit settings if you want to be less secure (not recommended tho).
• You trust that I didn't mess up the policykit settings (it runs for me and seems to prompt correctly but I offer no guarantees on the security)
• You are ok with less than stellar performance resulting from hand-off to bash script behind the scenes

---

Setup

This will require creating 3 files and editing a fourth (for the policykit definitions).

1. First, go ahead and create a temp folder and 3 temp files:

mkdir /tmp/chown-gui
cd /tmp/chown-gui
# create temp files - we'll rename these later when they get moved
touch tmp-pkexec tmp-sh tmp-action

2. Create the main bash script

File #1: tmp-sh (will end up at /usr/bin/chown-gui-wrapper)

#!/bin/bash

# v1.2.0
# Last updated on 2019 Oct 15

prompt_on_multiple_files="true";
default_to_once_for_all_paths_if_no_prompt="true";
apply_once_for_all_paths="false";

has_multiple_paths="false";
second_file="$2";
if [[ "" != "${second_file}" ]]; then
    has_multiple_paths="true";

    if [[ "true" == "${prompt_on_multiple_files}" ]]; then
        prompt_response=$( yad --center --button="gtk-ok:0" --title "Multiple Paths Detected" --form --field="\n    How would you like to apply permissions?    \n:LBL" "" --field="${label_hpadding}:CB" "Set permissions once and apply it to all paths\!Set permissions for each path individually");
        if [[ ! $prompt_response =~ ^.*individually.*$ ]]; then
            apply_once_for_all_paths="true";
        fi
    elif [[ "true" == "${default_to_once_for_all_paths_if_no_prompt}" ]]; then
        apply_once_for_all_paths="true";
    fi
fi

#echo "prompt_on_multiple_files=\"${prompt_on_multiple_files}\"";
#echo "default_to_once_for_all_paths_if_no_prompt=\"${default_to_once_for_all_paths_if_no_prompt}\"";
#echo "apply_once_for_all_paths=\"${apply_once_for_all_paths}\"";

popup_title="Please select the user and group owners";
popup_text="Please select the user and group owners for the following path:"
label_hpadding="    ";

for filepath in "${@}"; do
    #echo "filepath in array is $filepath";

    if [[ ! -e "${filepath}" ]]; then
        ERROR_MSG="ERROR: File '${filepath}' does not exist";
        notify-send --icon=error "${ERROR_MSG}";
        echo "${ERROR_MSG}";
        continue;
    fi
    filename=$(basename "${filepath}")
    current_user=$(stat -c "%U" "${filepath}");
    current_group=$(stat -c "%G" "${filepath}");

    show_checkbox="false";
    if [[ -d "${filepath}" ]]; then
        show_checkbox="true";
    fi

    # get list of non-service accounts/groups
    users_list=$(getent passwd {1000..60000}|awk -F: '{print $1}'|tr '\n' ' ');
    groups_list=$(getent group {1000..60000}|awk -F: '{print $1}'|tr '\n' ' ');

    sorted_user_list=$(echo $(printf '%s\n' root $users_list | sort -u)|sed -E "s/\\b($current_user)\\b/^\\1/g"|tr ' ' '\!');
    sorted_group_list=$(echo $(printf '%s\n' root $groups_list | sort -u)|sed -E "s/\\b($current_group)\\b/^\\1/g"|tr ' ' '\!');

    #echo "show_checkbox: ${show_checkbox}";
    if [[ "true" == "${show_checkbox}" ]]; then
        formdata=$(yad --center --button="gtk-cancel:1" --button="gtk-ok:0" --title "${popup_title}" --form --field="\n${label_hpadding}${popup_text}${label_hpadding}\n:LBL" "" --field="${label_hpadding}Path:${label_hpadding}:RO" "${filepath}" --field="${label_hpadding}User:${label_hpadding}:CBE" "${sorted_user_list}" --field="${label_hpadding}Group:${label_hpadding}:CBE" "${sorted_group_list}" --field "\n:LBL" "" --field="Apply Recursively?:CHK" "FALSE");
    else
        formdata=$(yad --center --button="gtk-cancel:1" --button="gtk-ok:0" --title "${popup_title}" --form --field="\n${label_hpadding}${popup_text}${label_hpadding}\n:LBL" "" --field="${label_hpadding}Path:${label_hpadding}:RO" "${filepath}" --field="${label_hpadding}User:${label_hpadding}:CBE" "${sorted_user_list}" --field="${label_hpadding}Group:${label_hpadding}:CBE" "${sorted_group_list}");
    fi
    if [[ "" == "$formdata" ]]; then
        echo "user pressed cancel for filepath '${filepath}'";
        continue;
    fi
    #echo "formdata=\"${formdata}\"";

    new_user=$(echo "${formdata}"|awk -F'|' '{print $3}');
    new_group=$(echo "${formdata}"|awk -F'|' '{print $4}');
    is_recursive="FALSE";
    if [[ "true" == "${show_checkbox}" ]]; then
        is_recursive=$(echo "${formdata}"|awk -F'|' '{print $6}');
    fi
    #echo "new_user=\"${new_user}\"";
    #echo "new_group=\"${new_group}\"";
    #echo "is_recursive=\"${is_recursive}\"";

    RECURSIVE_FLAG='';
    if [[ "TRUE" == "${is_recursive}" ]]; then
        RECURSIVE_FLAG='-R';
    fi

    if [[ "true" == "${has_multiple_paths}" && "true" == "${apply_once_for_all_paths}" ]]; then
        chown $RECURSIVE_FLAG "${new_user}":"${new_group}" "${@}";
        break;
    else
        chown $RECURSIVE_FLAG "${new_user}":"${new_group}" "${filepath}";
    fi
done

3. Create wrapper script

File #2: tmp-pkexec (will end up at /usr/bin/pkexec-chown-gui-wrapper)

#!/bin/bash

# v1.2.0
# Last Updated: 2019 Oct 15

yad_installed=$(which yad);
if [[ "" == "${yad_installed}" ]]; then
    ERROR_MSG="ERROR: Missing dependency 'yad'; Please run: sudo apt install -y yad;";
    notify-send --icon=error "${ERROR_MSG}";
    echo "${ERROR_MSG}";
    exit;
fi

pkexec --user root env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY /usr/bin/chown-gui-wrapper "${@}"

4. Create nemo action (so it appears in the right-click menu)

File #3: tmp-action (will end up at /usr/share/nemo/actions/change-owner.nemo_action)

[Nemo Action]
Name=Change Owner/Group
Comment=GUI wrapper for chown
Selection=s
Exec=/usr/bin/pkexec-chown-gui-wrapper %F
Icon-Name=gnome-settings
Extensions=any;
Quote=double

5. Copy all the temp files to the appropriate locations and set permissions

cd /tmp/chown-gui
sudo cp tmp-sh /usr/bin/chown-gui-wrapper;
sudo cp tmp-pkexec /usr/bin/pkexec-chown-gui-wrapper;
sudo cp tmp-action /usr/share/nemo/actions/change-owner.nemo_action;

sudo chown root:root /usr/bin/chown-gui-wrapper;
sudo chown root:root /usr/bin/pkexec-chown-gui-wrapper;
sudo chown root:root /usr/share/nemo/actions/change-owner.nemo_action;

sudo chmod 755 /usr/bin/chown-gui-wrapper;
sudo chmod 755 /usr/bin/pkexec-chown-gui-wrapper;
sudo chmod 644 /usr/share/nemo/actions/change-owner.nemo_action;
# This part is needed if you want to be able to use this in nemo with
# single-file selections AND multiple-file selections BUT NOT when
# there is NO selection (e.g. directory background).
# Nemo's 'Selection' option doesn't currently allow multiple values
#   and 'm' only considers "2+" and 'a' considers "0+"
# whereas this gives us "1,2+"
#
sudo cp -a /usr/share/nemo/actions/change-owner.nemo_action /usr/share/nemo/actions/change-owner-single-file.nemo_action;
sudo mv /usr/share/nemo/actions/change-owner.nemo_action /usr/share/nemo/actions/change-owner-multiple-files.nemo_action;
sudo sed -i -E 's/^(Selection)=s/\1=m/' /usr/share/nemo/actions/change-owner-multiple-files.nemo_action;

6. Make sure yad is installed. This absolutely will not work without it. You could potentially replace it with zenity (but since yad is a fork of zenity, that seems rather pointless to me)

sudo apt install -y yad

7. Create policykit exceptions

You may or may not already have a pkexec.policy file. If you do, then you only want to add the <action>...</action> block. If you don't have the file, then create it (chmod 664 and chown root:root:) and copy the entire <policyconfig>...</policyconfig> block.

Policykit file to edit/create: /usr/share/polkit-1/actions/org.freedesktop.policykit.pkexec.policy

Contents (new file):

<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>
  <action id="org.freedesktop.policykit.pkexec.run-chown-gui-wrapper">
    <description>GUI wrapper for chown</description>
    <message>Authentication is required to run chown-gui-wrapper</message>
    <icon_name>gnome-settings</icon_name>
    <defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/bin/bash</annotate>
    <annotate key="org.freedesktop.policykit.exec.argv1">/usr/bin/chown-gui-wrapper</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">TRUE</annotate>
  </action>
</policyconfig>

8. Confirm setup

# make dummy file to test with
echo dummy > /tmp/foo.txt

# check that you get the gui pop-up
# no need for root, just confirm gui comes up, then you can cancel
/usr/bin/chown-gui-wrapper /tmp/foo.txt

# check that you get the gui pop-up
# might prompt for auth, just confirm gui comes up, then you can cancel
/usr/bin/pkexec-chown-gui-wrapper /tmp/foo.txt

if launching from terminal, then just confirm the nemo context-menu option works and all good.

---

Screenshots / Preview

popup created with yad

it automatically filters to root + non-service users/groups:

note: the drop-downs are actually sorted A-Z descending; but I edited my usernames in the image... because this is the internet :-)