Home / server / Questions / 387625
Accepted
Julie in Austin
Asked: 2012-05-10 12:19:59 +0800 CST

"System File Checker" (sfc-like) for Linux

  • 772

I am trying to locate a tool, not unlike either the "sfc" command on Windows or the "sysck" command on AIX, which can verify that the file contents, ownerships and permissions are correct. The "replace damaged or missing files" functionality in "sfc" isn't what I'm looking for, it's the "verify that all the right parts are in all the right places" capabilities.

The task I'm trying to perform is verifying that a number of different installation and upgrade paths to a specific software release on an embedded Linux product reach the same overall filesystem state -- all the required files and directories exist, have the correct contents (as told by md5sums or similar), owner, group and permissions.

A collection of individual commands -- find, stat, test, etc. -- isn't what I'm looking for. I'm looking for a TOOL, such as either of the ones I mentioned above.

I've searched high and low, but so many of the searches turn up "fsck" that any positive hits are being buried.

filesystems verification

5 Answers

  1. Best Answer

    You are probably looking for a host-based IDS like Tripwire - it is capable of checking permissions, ownerships and filesystem checksums against a custom policy. Windows SFC does essentially the same thing but on a periodic basis and with a policy which is predefined by Microsoft and cannot be changed by the system's administrator.

    Unfortunately, you essentially would have to do manual change runs for the file hash and permission database each time you update your system as major distros would not provide you with pre-populated databases for system integrity verification:

    Tripwire graph From the Red Hat docs

    (taken from http://www.centos.org/docs/2/rhl-rg-en-7.2/ch-tripwire.html)

    • 3

  2. The closest thing I can think of (on redhat based systems) is rpm -aV. This is the verify portion of rpm, which will attempt to check md5 sums, files modes and ownerships are correctly placed for files that are listed as part of the package being inspected, with -a you can do every package which makes up the system.

    rpm -aV

    If you want to fix permissions and modes of packages (all is a bit dangerous possibly).

    rpm --setperms --setugids -a

    But the best way to make this work is to run rpm -aV, check the output and ensure / account for any anomalous results each package/file produces. Then on the files/packages that produce errors you can then either reinstall the package (if files differ) or reset the uids/gids/mode on the package provided in the verify output.

    • 2

  3. Use find + stat combination to get the desired results.

    Eg: find /path -type f -exec stat {} \;

      # stat RTM_hpc.txt

  File: `RTM_hpc'
  Size: 2361        Blocks: 8          IO Block: 4096   regular file
  Device: 822h/2082d    Inode: 1059093     Links: 1
  Access: (0644/-rw-r--r--)  Uid: (  500/  chakri)   Gid: (  100/   users)
  Access: 2011-12-08 14:07:42.028802069 -0600
  Modify: 2011-05-31 08:18:46.000000000 -0500
  Change: 2011-07-19 09:09:03.952958097 -0500
    • 1

  4. How is the "everything in the right place" defined?

    rsync -av --dry-run, probably with -c and --numeric-ids against a reference copy of the filesystem, might do fine for some use cases.

    • 1

  5. Maybe you could use rkhunter for what you need. It checks the permissions and hashes against a database, but it's meant more for finding rootkits. Tripwire would be better, but if you need something more simple.

    • 0