229 lines
9.2 KiB
Bash
Executable File
229 lines
9.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================================
|
|
# ============================= Bulk Permissions Repair ========================================
|
|
# ==============================================================================================
|
|
#
|
|
# PURPOSE
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Applies correct ownership and permissions to one or more specific paths.
|
|
# Targeted repair — faster than media_shares_permissions.sh, which processes
|
|
# every configured share. Use after failed transfers that left root:root ownership,
|
|
# containers writing as root before PUID/PGID was fixed, manual file copies, or
|
|
# new shares that need permissions applied before the next nightly run.
|
|
#
|
|
# Counts files with wrong ownership before fixing. A high count on a recently
|
|
# written share means a container has wrong PUID/PGID — add PUID=99 PGID=100
|
|
# to its Docker template. Common culprits: SABnzbd, qBittorrent, slskd.
|
|
#
|
|
# ==============================================================================================
|
|
# DESIGN PRINCIPLES
|
|
# ==============================================================================================
|
|
#
|
|
# Permissions Model
|
|
# Directories (PERMISSIONS_DIR_MODE, default 755):
|
|
# Owner (nobody) — rwx enter, list, create files
|
|
# Group (users) — r-x enter and list
|
|
# Others — r-x Samba guests can browse
|
|
# Files (PERMISSIONS_FILE_MODE, default 664):
|
|
# Owner (nobody) — rw read + write
|
|
# Group (users) — rw arrs can import and rename
|
|
# Others — r Samba guests can read
|
|
# No execute bit — media files are never executable
|
|
#
|
|
# Separate Passes
|
|
# Directories and files are chmod'd in separate find passes. A combined pass
|
|
# with mode 664 would wrongly strip the execute bit from directories, making
|
|
# them untraversable.
|
|
#
|
|
# ==============================================================================================
|
|
# OPERATIONAL SAFEGUARDS
|
|
# ==============================================================================================
|
|
#
|
|
# Root Required
|
|
# chown requires root — exits immediately if not running as root.
|
|
#
|
|
# Path Existence Check
|
|
# Each path is verified before processing — missing paths log an error and
|
|
# are skipped rather than silently passing.
|
|
#
|
|
# Notification Validated
|
|
# platform_require_cmd confirms the notify script is present before use.
|
|
#
|
|
# Silent on Success
|
|
# Only failures and the wrong-owner diagnostic produce visible output.
|
|
#
|
|
# ==============================================================================================
|
|
# CONFIGURATION
|
|
# ==============================================================================================
|
|
#
|
|
# master.conf
|
|
#
|
|
# PERMISSIONS_OWNER
|
|
# Owner applied to all paths. (default: nobody:users)
|
|
#
|
|
# PERMISSIONS_DIR_MODE
|
|
# chmod mode for directories. (default: 755)
|
|
#
|
|
# PERMISSIONS_FILE_MODE
|
|
# chmod mode for files. (default: 664)
|
|
#
|
|
# ==============================================================================================
|
|
# RUNTIME MODES
|
|
# ==============================================================================================
|
|
#
|
|
# bulk_permissions_repair.sh /path/to/share [/another/path ...]
|
|
# Apply ownership and permissions to each specified path.
|
|
#
|
|
# bulk_permissions_repair.sh /path/to/share --dry-run
|
|
# Show wrong-owner count per path. No chown or chmod applied.
|
|
#
|
|
# bulk_permissions_repair.sh /path/to/share --log
|
|
# Verbose output including per-path file counts and modes applied.
|
|
#
|
|
# ==============================================================================================
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
source "$SCRIPT_DIR/../load_config.sh"
|
|
|
|
parse_args "$@"
|
|
|
|
# ==============================================================================================
|
|
# ━━━ Setup ━━━
|
|
# ==============================================================================================
|
|
if [[ "$EUID" -ne 0 ]]; then
|
|
error "Must be run as root — chown requires root"
|
|
exit 1
|
|
fi
|
|
|
|
acquire_lock
|
|
|
|
|
|
# detect_hosts() sets MY_ID — used in summary
|
|
detect_hosts
|
|
|
|
if [[ ${#PARSED_ARGS[@]} -eq 0 ]]; then
|
|
error "No paths specified"
|
|
error "Usage: bulk_permissions_repair.sh /path/to/share [/another/path] [--dry-run]"
|
|
exit 1
|
|
fi
|
|
|
|
log "Dir mode: ${PERMISSIONS_DIR_MODE:-755}"
|
|
log "File mode: ${PERMISSIONS_FILE_MODE:-664}"
|
|
log "Owner: $PERMISSIONS_OWNER"
|
|
[[ "$DRY_RUN" == true ]] && warn "DRY RUN — no permissions will be changed"
|
|
|
|
# ==============================================================================================
|
|
# ━━━ Apply Permissions ━━━
|
|
# ==============================================================================================
|
|
echo ""
|
|
echo "━━━ $ICON_PERMS Permissions Repair — $MY_ID ━━━"
|
|
|
|
START=$(date +%s)
|
|
PASS=()
|
|
FAIL=()
|
|
TOTAL_WRONG_OWNER=0
|
|
|
|
for share_path in "${PARSED_ARGS[@]}"; do
|
|
[[ -z "$share_path" ]] && continue
|
|
|
|
echo ""
|
|
echo "━━━ $ICON_PERMS $(basename "$share_path") ━━━"
|
|
|
|
if [[ ! -d "$share_path" ]]; then
|
|
error "$share_path — not found"
|
|
FAIL+=("$share_path")
|
|
continue
|
|
fi
|
|
|
|
# Count files for context — warn level so user knows what they're in for on large shares
|
|
FILE_COUNT=$(find "$share_path" -type f 2>/dev/null | wc -l)
|
|
DIR_COUNT=$(find "$share_path" -type d 2>/dev/null | wc -l)
|
|
SIZE=$(du -sh "$share_path" 2>/dev/null | cut -f1)
|
|
warn "$share_path — $FILE_COUNT files, $DIR_COUNT dirs ($SIZE)"
|
|
|
|
# Count files with wrong ownership before fixing — diagnostic
|
|
WRONG_OWNER=$(find "$share_path" \( ! -user nobody -o ! -group users \) \
|
|
2>/dev/null | wc -l)
|
|
if [[ "$WRONG_OWNER" -gt 0 ]]; then
|
|
warn "$WRONG_OWNER file(s) with wrong ownership — fixing..."
|
|
if [[ "$WRONG_OWNER" -gt 500 ]]; then
|
|
warn "High wrong-owner count — check container PUID/PGID settings (should be PUID=99 PGID=100)"
|
|
warn "Common culprits: SABnzbd, qBittorrent, slskd"
|
|
fi
|
|
TOTAL_WRONG_OWNER=$(( TOTAL_WRONG_OWNER + WRONG_OWNER ))
|
|
else
|
|
log "Ownership already correct — applying mode only"
|
|
fi
|
|
|
|
if [[ "$DRY_RUN" == true ]]; then
|
|
warn "DRY RUN — would apply:"
|
|
warn " chown -R $PERMISSIONS_OWNER $share_path"
|
|
warn " find -type d → chmod ${PERMISSIONS_DIR_MODE:-755}"
|
|
warn " find -type f → chmod ${PERMISSIONS_FILE_MODE:-664}"
|
|
PASS+=("$(basename "$share_path")")
|
|
continue
|
|
fi
|
|
|
|
CHOWN_OK=true
|
|
CHMOD_DIR_OK=true
|
|
CHMOD_FILE_OK=true
|
|
|
|
# Apply ownership first
|
|
log "Applying ownership: $PERMISSIONS_OWNER..."
|
|
chown -R "$PERMISSIONS_OWNER" "$share_path" 2>/dev/null || CHOWN_OK=false
|
|
|
|
# Apply directory permissions — separate pass (dirs need execute bit)
|
|
log "Applying directory permissions: ${PERMISSIONS_DIR_MODE:-755}..."
|
|
find "$share_path" -type d \
|
|
-exec chmod "${PERMISSIONS_DIR_MODE:-755}" {} + 2>/dev/null || CHMOD_DIR_OK=false
|
|
|
|
# Apply file permissions — no execute bit on media files
|
|
log "Applying file permissions: ${PERMISSIONS_FILE_MODE:-664}..."
|
|
find "$share_path" -type f \
|
|
-exec chmod "${PERMISSIONS_FILE_MODE:-664}" {} + 2>/dev/null || CHMOD_FILE_OK=false
|
|
|
|
if [[ "$CHOWN_OK" == true && "$CHMOD_DIR_OK" == true && "$CHMOD_FILE_OK" == true ]]; then
|
|
echo "$ICON_UNLOCKED $(basename "$share_path") — permissions applied ✅"
|
|
PASS+=("$(basename "$share_path")")
|
|
else
|
|
error "$(basename "$share_path") — repair failed"
|
|
error " chown: $CHOWN_OK chmod dirs: $CHMOD_DIR_OK chmod files: $CHMOD_FILE_OK"
|
|
FAIL+=("$(basename "$share_path")")
|
|
fi
|
|
done
|
|
|
|
END=$(date +%s)
|
|
|
|
# ==============================================================================================
|
|
# ━━━ Summary ━━━
|
|
# ==============================================================================================
|
|
echo ""
|
|
echo "━━━━━ $ICON_SUMMARY PERMISSIONS REPAIR SUMMARY ━━━━━"
|
|
echo "$ICON_HOST Identity: $MY_ID ($LOCAL_SERVER_NAME)"
|
|
echo "$ICON_PERMS Dir mode: ${PERMISSIONS_DIR_MODE:-755}"
|
|
echo "$ICON_PERMS File mode: ${PERMISSIONS_FILE_MODE:-664}"
|
|
echo "$ICON_PERMS Owner: $PERMISSIONS_OWNER"
|
|
echo "$ICON_TIME Duration: $(format_duration $(( END - START )))"
|
|
echo ""
|
|
[[ ${#PASS[@]} -gt 0 ]] && log "Pass: ${PASS[*]}"
|
|
[[ ${#FAIL[@]} -gt 0 ]] && echo "$ICON_ERROR Fail: ${FAIL[*]}"
|
|
|
|
if [[ "$TOTAL_WRONG_OWNER" -gt 0 ]]; then
|
|
warn "Total wrong-owner files fixed: $TOTAL_WRONG_OWNER"
|
|
fi
|
|
echo ""
|
|
|
|
if [[ "$DRY_RUN" == true ]]; then
|
|
warn "DRY RUN — no changes made"
|
|
elif [[ ${#FAIL[@]} -gt 0 ]]; then
|
|
echo "$ICON_ERROR Status: SOME REPAIRS FAILED"
|
|
notify "Permissions repair failed on $(hostname) — ${FAIL[*]}" \
|
|
"Permissions Repair" "warning"
|
|
else
|
|
echo "$ICON_DONE Status: done — ${#PASS[@]} path(s) repaired"
|
|
fi
|
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
|
|
|
[[ ${#FAIL[@]} -gt 0 ]] && exit 1
|
|
exit 0 |