integrit-users

[Integrit-users] Script to roll back filesystem changes as reported by integrit?

[Antoine <abo...@ya...>]

Hello all, 

I just did a classic chown -R root:root .* and now my
whole filesystem is owned by root. Some apps like the
mailer daemon or MySQL don't seem to like that very
much.  (Users wouldn't like that very much either, but
luckily I'm the only user on that system.. :) 

Now I have a good integrit database from last night,
and I'm thinking that it could help me undo the
changes at least on /usr, /bin etc. 

So I'm looking for a script that can parse the changes
output by integrit and revert the affected files to
the last known good state. Maybe someone here had to
write such a thing in the past or can point me in the
right direction? A quick web search didn't yield
anything. 

All that interests me really is the changes in
ownership, and optionally mtime/atime. 

thanks,
antoine



		
__________________________________ 
Do you Yahoo!? 
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/ 

Re: [Integrit-users] Script to roll back filesystem changes as reported by integrit?

[Ed L. C. <ec...@gm...>]

On 4/22/05, Antoine <abo...@ya...> wrote:
...
> So I'm looking for a script that can parse the changes
> output by integrit and revert the affected files to
> the last known good state. Maybe someone here had to
> write such a thing in the past or can point me in the
> right direction? A quick web search didn't yield
> anything.

It does sound like something that could be=20
scripted with a little sed.  I don't usually post
untested scripts, but this is just to convey a
general approach ...

while read line; do
  uid=3D"`echo $line | sed -n '/^changed:/s/u[(]\([^:][^:]*\):/p'`"
  test "$uid" || continue
  fnam=3D"`echo $line | sed -e 's!^changed: !!' -e 's!  *.*!!'`"
  chown $uid $fnam
done

Whitespace in filenames will break the script.

--=20
  Ed L. Cashin <ec...@no...>