# 1. 检查无主文件
# find /home -nouser -ls
（输出无主文件）

# 2. 检查无组文件
# find /home -nogroup -ls
（输出无组文件）

# 3. 检查所有者为普通用户的系统文件
# find /etc -user fgedu -ls
（输出所有者为普通用户的系统文件）

# 4. 检查敏感文件所有权
# ls -l /etc/shadow /etc/gshadow /etc/ssh/sshd_config
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/gshadow
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/shadow
-rw——-. 1 root root root 1234 Apr 2 10:00 /etc/ssh/sshd_config

# 5. 修复敏感文件所有权
# chown root:root /etc/shadow
# chown root:root /etc/gshadow
# chown root:root /etc/ssh/sshd_config

# 6. 检查应用文件所有权
# find /app -ls | head -n 10
1234567 4 drwxr-xr-x 2 app app 4096 Apr 2 10:00 /app/bin
1234568 4 drwxr-xr-x 2 app app 4096 Apr 2 10:00 /app/conf
1234569 4 drwxr-xr-x 2 app app 4096 Apr 2 10:00 /app/logs

# 7. 检查临时文件所有权
# find /tmp -user root -type f -ls | head -n 10
（输出root拥有的临时文件）

# 8. 检查用户目录所有权
# ls -ld /home/*
drwx——. 2 fgedu fgedu 62 Apr 2 10:00 /home/fgedu
drwx——. 2 user1 user1 62 Apr 2 10:00 /home/user1

# 9. 检查共享目录所有权
# ls -ld /shared/*
drwxrwsr-x. 2 root developers 4096 Apr 2 10:00 /shared/projectA
drwxrwsr-x. 2 root ops 4096 Apr 2 10:00 /shared/projectB

# 10. 监控所有权变更
# auditctl -w /etc/passwd -p a -k ownership_changes
# ausearch -k ownership_changes

# 1. 创建所有权审计脚本
# cat > /tmp/ownership_audit.sh << 'EOF' #!/bin/bash REPORT="/tmp/ownership_audit_report.txt" echo "========================================" > $REPORT
echo “Ownership Audit Report – $(date)” >> $REPORT
echo “========================================” >> $REPORT
echo “” >> $REPORT

# 1. 检查无主文件
echo “1. Unowned Files (No User)” >> $REPORT
echo “—————————” >> $REPORT
find /home -nouser -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 2. 检查无组文件
echo “2. Unowned Files (No Group)” >> $REPORT
echo “—————————-” >> $REPORT
find /home -nogroup -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 3. 检查系统文件所有权
echo “3. System File Ownership” >> $REPORT
echo “————————-” >> $REPORT
ls -l /etc/passwd /etc/shadow /etc/group /etc/gshadow >> $REPORT
echo “” >> $REPORT

# 4. 检查应用文件所有权
echo “4. Application File Ownership” >> $REPORT
echo “——————————” >> $REPORT
find /app -maxdepth 2 -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 5. 检查用户目录所有权
echo “5. User Home Directory Ownership” >> $REPORT
echo “———————————” >> $REPORT
ls -ld /home/* >> $REPORT
echo “” >> $REPORT

# 6. 检查共享文件所有权
echo “4. Shared File Ownership” >> $REPORT
echo “————————-” >> $REPORT
find /shared -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 5. 检查用户目录所有权
echo “5. User Home Directory Ownership” >> $REPORT
echo “———————————” >> $REPORT
ls -ld /home/* >> $REPORT
echo “” >> $REPORT

# 6. 检查应用文件所有权
echo “6. Application File Ownership” >> $REPORT
echo “——————————” >> $REPORT
find /app -maxdepth 2 -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

# 7. 检查临时文件所有权
echo “7. Temporary File Ownership” >> $REPORT
echo “—————————-” >> $REPORT
find /tmp -maxdepth 2 -ls 2>/dev/null | head -n 20 >> $REPORT
echo “” >> $REPORT

# 8. 检查SUID文件所有权
echo “8. SUID File Ownership” >> $REPORT
echo “———————–” >> $REPORT
find /usr -perm -4000 -ls 2>/dev/null >> $REPORT
echo “” >> $REPORT

echo “Audit completed. Report saved to $REPORT”
EOF

# 2. 执行审计脚本
# chmod +x /tmp/ownership_audit.sh
# /tmp/ownership_audit.sh
Audit completed. Report saved to /tmp/ownership_audit_report.txt

# 3. 查看审计报告
# cat /tmp/ownership_audit_report.txt
========================================
Ownership Audit Report – Fri Apr 2 10:00:00 CST 2026
========================================

1. Unowned Files (No User)
—————————

2. Unowned Files (No Group)
—————————-

3. System File Ownership
————————-
-rw-r–r–. 1 root root 1234 Apr 2 10:00 /etc/group
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/gshadow
-rw-r–r–. 1 root root 1234 Apr 2 10:00 /etc/passwd
-rw——-. 1 root root 1234 Apr 2 10:00 /etc/shadow

4. Shared File Ownership
————————-

5. User Home Directory Ownership
———————————
drwx——. 2 fgedu fgedu 62 Apr 2 10:00 /home/fgedu

6. Application File Ownership
——————————

7. Temporary File Ownership
—————————-
1234567 4 drwxrwxrwt 10 root root 4096 Apr 2 10:00 /tmp

8. SUID File Ownership
———————–
1234568 12 -rwsr-xr-x 1 root root 12345 Apr 2 10:00 /usr/bin/sudo
1234569 12 -rwsr-xr-x 1 root root 12345 Apr 2 10:00 /usr/bin/passwd

# 1. 修改文件所有者
# touch file.txt
# chown fgedu file.txt
# ls -l file.txt
-rw-r–r–. 1 fgedu root 0 Apr 2 10:00 file.txt

# 2. 修改文件所有者和所属组
# chown fgedu:fgedu file.txt
# ls -l file.txt
-rw-r–r–. 1 fgedu fgedu 0 Apr 2 10:00 file.txt

# 3. 修改文件所属组（使用冒号）
# chown :developers file.txt
# ls -l file.txt
-rw-r–r–. 1 fgedu developers 0 Apr 2 10:00 file.txt

# 4. 修改文件所有者和所属组（使用点号）
# chown root.root file.txt
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 5. 递归修改目录所有权
# mkdir -p /tmp/test/{dir1,dir2}
# touch /tmp/test/{file1,file2}
# chown -R fgedu:fgedu /tmp/test
# ls -lR /tmp/test
/tmp/test:
total 0
drwxr-xr-x. 2 fgedu fgedu 6 Apr 2 10:00 dir1
drwxr-xr-x. 2 fgedu fgedu 6 Apr 2 10:00 dir2
-rw-r–r–. 1 fgedu fgedu 0 Apr 2 10:00 file1
-rw-r–r–. 1 fgedu fgedu 0 Apr 2 10:00 file2

# 6. 修改文件所有者（使用UID）
# chown 1000 file.txt
# ls -l file.txt
-rw-r–r–. 1 fgedu root 0 Apr 2 10:00 file.txt

# 7. 修改文件所属组（使用GID）
# chown :1000 file.txt
# ls -l file.txt
-rw-r–r–. 1 fgedu fgedu 0 Apr 2 10:00 file.txt

# 8. 修改文件所有者和所属组（使用UID和GID）
# chown 0:0 file.txt
# ls -l file.txt
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt

# 9. 参考文件所有权
# chown –reference=/etc/passwd file.txt
# ls -l file.txt /etc/passwd
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt
-rw-r–r–. 1 root root 1234 Apr 2 10:00 /etc/passwd

# 10. 修改多个文件所有权
# touch file1.txt file2.txt file3.txt
# chown fgedu:fgedu file1.txt file2.txt file3.txt
# ls -l file*.txt
-rw-r–r–. 1 fgedu fgedu 0 Apr 2 10:00 file1.txt
-rw-r–r–. 1 fgedu fgedu 0 Apr 2 10:00 file2.txt
-rw-r–r–. 1 fgedu fgedu 0 Apr 2 10:00 file3.txt

# 11. 修改符号链接所有权
# ln -s file.txt link.txt
# chown -h fgedu:fgedu link.txt
# ls -l link.txt
lrwxrwxrwx. 1 fgedu fgedu 8 Apr 2 10:00 link.txt -> file.txt

# 12. 修改目录所有权（不递归）
# mkdir dir1
# chown fgedu:fgedu dir1
# ls -ld dir1
drwxr-xr-x. 2 fgedu fgedu 6 Apr 2 10:00 dir1

# 13. 修改所有权并显示详细信息
# chown -v root:root file.txt
changed ownership of ‘file.txt’ from fgedu:fgedu to root:root

# 14. 修改所有权（不显示错误）
# chown -f fgedu:fgedu file.txt

# 15. 批量修改所有权
# find /tmp -name “*.txt” -exec chown fgedu:fgedu {} \;

# 1. 修改文件所属组
# touch file.txt
# chgrp developers file.txt
# ls -l file.txt
-rw-r–r–. 1 root developers 0 Apr 2 10:00 file.txt

# 2. 修改目录所属组
# mkdir dir1
# chgrp developers dir1
# ls -ld dir1
drwxr-xr-x. 2 root developers 6 Apr 2 10:00 dir1

# 3. 递归修改目录所属组
# mkdir -p /tmp/test/{dir1,dir2}
# touch /tmp/test/{file1,file2}
# chgrp -R developers /tmp/test
# ls -lR /tmp/test
/tmp/test:
total 0
drwxr-xr-x. 2 root developers 6 Apr 2 10:00 dir1
drwxr-xr-x. 2 root developers 6 Apr 2 10:00 dir2
-rw-r–r–. 1 root developers 0 Apr 2 10:00 file1
-rw-r–r–. 1 root developers 0 Apr 2 10:00 file2

# 4. 修改文件所属组（使用GID）
# chgrp 1000 file.txt
# ls -l file.txt
-rw-r–r–. 1 root fgedu 0 Apr 2 10:00 file.txt

# 5. 参考文件所属组
# chgrp –reference=/etc/passwd file.txt
# ls -l file.txt /etc/passwd
-rw-r–r–. 1 root root 0 Apr 2 10:00 file.txt
-rw-r–r–. 1 root root 1234 Apr 2 10:00 /etc/passwd

# 6. 修改多个文件所属组
# touch file1.txt file2.txt file3.txt
# chgrp developers file1.txt file2.txt file3.txt
# ls -l file*.txt
-rw-r–r–. 1 root developers 0 Apr 2 10:00 file1.txt
-rw-r–r–. 1 root developers 0 Apr 2 10:00 file2.txt
-rw-r–r–. 1 root developers 0 Apr 2 10:00 file3.txt

# 7. 修改符号链接所属组
# ln -s file.txt link.txt
# chgrp -h developers link.txt
# ls -l link.txt
lrwxrwxrwx. 1 root developers 8 Apr 2 10:00 link.txt -> file.txt

# 8. 修改所属组并显示详细信息
# chgrp -v fgedu file.txt
changed group of ‘file.txt’ from developers to fgedu

# 9. 修改所属组（不显示错误）
# chgrp -f developers file.txt

# 10. 批量修改所属组
# find /tmp -name “*.txt” -exec chgrp developers {} \;

# 11. 修改共享目录所属组
# mkdir /shared/projectA
# chgrp developers /shared/projectA
# chmod 2775 /shared/projectA
# ls -ld /shared/projectA
drwxrwsr-x. 2 root developers 6 Apr 2 10:00 /shared/projectA

# 12. 修改日志文件所属组
# mkdir /var/log/app
# chgrp app /var/log/app
# ls -ld /var/log/app
drwxr-xr-x. 2 root app 6 Apr 2 10:00 /var/log/app

# 13. 修改配置文件所属组
# touch /etc/app/app.conf
# chgrp app /etc/app/app.conf
# ls -l /etc/app/app.conf
-rw-r–r–. 1 root app 0 Apr 2 10:00 /etc/app/app.conf

# 14. 修改数据文件所属组
# mkdir /data/app
# chgrp app /data/app
# ls -ld /data/app
drwxr-xr-x. 2 root app 6 Apr 2 10:00 /data/app

# 15. 检查所属组修改
# stat -c “%G” file.txt
developers

# 1. 批量修改所有权（按类型）
# mkdir -p /app/{bin,conf,logs,data}

# 目录设置为app:app
# find /app -type d -exec chown app:app {} \;

# 文件设置为app:app
# find /app -type f -exec chown app:app {} \;

# 验证所有权
# ls -lR /app
/app:
total 0
drwxr-xr-x. 2 app app 6 Apr 2 10:00 bin
drwxr-xr-x. 2 app app 6 Apr 2 10:00 conf
drwxr-xr-x. 2 app app 6 Apr 2 10:00 data
drwxr-xr-x. 2 app app 6 Apr 2 10:00 logs

# 2. 修复用户目录所有权
# cat > /tmp/fix_home_ownership.sh << 'EOF' #!/bin/bash for user in $(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
home_dir=$(awk -F: -v u=$user ‘$1 == u {print $6}’ /etc/passwd)

if [ -d “$home_dir” ]; then
# 修复家目录所有权
chown -R $user:$user $home_dir

echo “Fixed ownership for $user”
fi
done
EOF

# chmod +x /tmp/fix_home_ownership.sh
# /tmp/fix_home_ownership.sh

# 3. 修复无主文件所有权
# cat > /tmp/fix_unowned_files.sh << 'EOF' #!/bin/bash # 查找无主文件 find /home -nouser -o -nogroup | while read file; do # 设置为root:root chown root:root "$file" echo "Fixed ownership for $file" done EOF # 4. 复制所有权（从模板文件） # cat > /tmp/copy_ownership.sh << 'EOF' #!/bin/bash TEMPLATE_DIR="/tmp/template" TARGET_DIR="/tmp/target" # 复制所有权 find $TEMPLATE_DIR -printf "%P\n" | while read file; do if [ -e "$TARGET_DIR/$file" ]; then chown --reference="$TEMPLATE_DIR/$file" "$TARGET_DIR/$file" echo "Copied ownership to $TARGET_DIR/$file" fi done EOF # 5. 所有权备份和恢复 # 备份所有权 # find /app -printf "%p %u:%g\n" > /tmp/app_ownership.txt

# 恢复所有权
# cat /tmp/app_ownership.txt | while read file owner; do
chown $owner $file
done

# 6. 监控所有权变更
# auditctl -w /etc/passwd -p a -k ownership_changes
# auditctl -w /etc/shadow -p a -k ownership_changes
# auditctl -w /etc/group -p a -k ownership_changes

# 查看变更记录
# ausearch -k ownership_changes

# 7. 批量修改共享目录所有权
# cat > /tmp/fix_shared_ownership.sh << 'EOF' #!/bin/bash SHARED_DIR="/shared" # 设置目录所有权 chown -R root:developers $SHARED_DIR/projectA chown -R root:ops $SHARED_DIR/projectB chown -R root:dba $SHARED_DIR/projectC echo "Shared directory ownership fixed" EOF # 8. 所有权一致性检查 # cat > /tmp/check_ownership_consistency.sh << 'EOF' #!/bin/bash DIR=$1 if [ -z "$DIR" ]; then echo "Usage: $0 ”
exit 1
fi

# 检查所有权一致性
find $DIR -type f -printf “%u:%g\n” | sort | uniq -c | sort -nr

echo “Ownership consistency check completed”
EOF

# 9. 所有权变更日志
# cat > /tmp/log_ownership_changes.sh << 'EOF' #!/bin/bash LOG_FILE="/var/log/ownership_changes.log" # 记录所有权变更 log_change() { echo "$(date): $1 ownership changed to $2" >> $LOG_FILE
}

# 使用示例
# chown fgedu:fgedu file.txt
# log_change “file.txt” “fgedu:fgedu”
EOF

# 10. 所有权模板应用
# cat > /tmp/apply_ownership_template.sh << 'EOF' #!/bin/bash # 定义所有权模板 declare -A OWNERSHIP=( ["/app/bin"]="app:app" ["/app/conf"]="app:app" ["/app/logs"]="app:app" ["/app/data"]="app:app" ["/var/log/app"]="app:app" ["/etc/app"]="root:app" ) for dir in "${!OWNERSHIP[@]}"; do if [ -d "$dir" ]; then chown -R ${OWNERSHIP[$dir]} "$dir" echo "Applied ownership ${OWNERSHIP[$dir]} to $dir" fi done EOF

# 1. 批量设置Web目录所有权
# cat > /tmp/setup_web_ownership.sh << 'EOF' #!/bin/bash WEB_ROOT="/var/www/html" # 设置所有者 chown -R apache:apache $WEB_ROOT # 设置上传目录 chown -R apache:apache $WEB_ROOT/uploads # 设置配置文件 chown root:apache $WEB_ROOT/.htaccess # 设置日志目录 chown -R apache:apache $WEB_ROOT/logs echo "Web ownership configured" EOF # 2. 批量设置应用目录所有权 # cat > /tmp/setup_app_ownership.sh << 'EOF' #!/bin/bash APP_ROOT="/opt/app" # 创建应用用户 useradd -r -s /sbin/nologin app # 设置所有者 chown -R app:app $APP_ROOT # 设置配置文件 chown root:app $APP_ROOT/conf/*.conf # 设置日志目录 chown -R app:app $APP_ROOT/logs # 设置数据目录 chown -R app:app $APP_ROOT/data echo "App ownership configured" EOF # 3. 批量修复用户目录所有权 # cat > /tmp/fix_user_home_ownership.sh << 'EOF' #!/bin/bash for user in $(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}’ /etc/passwd); do
home_dir=$(awk -F: -v u=$user ‘$1 == u {print $6}’ /etc/passwd)

if [ -d “$home_dir” ]; then
# 修复家目录所有权
chown -R $user:$user $home_dir

# 修复SSH目录所有权
if [ -d “$home_dir/.ssh” ]; then
chown -R $user:$user $home_dir/.ssh
chmod 700 $home_dir/.ssh
chmod 600 $home_dir/.ssh/authorized_keys
fi

echo “Fixed ownership for $user”
fi
done
EOF

# 4. 批量设置共享目录所有权
# cat > /tmp/setup_shared_ownership.sh << 'EOF' #!/bin/bash SHARED_DIR="/shared" # 创建共享目录 mkdir -p $SHARED_DIR/{projectA,projectB,projectC} # 设置所有权 chown -R root:developers $SHARED_DIR/projectA chown -R root:ops $SHARED_DIR/projectB chown -R root:dba $SHARED_DIR/projectC # 设置权限 chmod -R 2775 $SHARED_DIR/projectA chmod -R 2775 $SHARED_DIR/projectB chmod -R 2775 $SHARED_DIR/projectC echo "Shared ownership configured" EOF # 5. 批量修复无主文件 # cat > /tmp/fix_unowned_files.sh << 'EOF' #!/bin/bash # 查找并修复无主文件 find /home -nouser -exec chown root:root {} \; 2>/dev/null
find /home -nogroup -exec chgrp root {} \; 2>/dev/null

# 查找并修复无主目录
find /home -nouser -type d -exec chown root:root {} \; 2>/dev/null
find /home -nogroup -type d -exec chgrp root {} \; 2>/dev/null

echo “Unowned files fixed”
EOF

# 1. 系统文件所有权加固
# cat > /tmp/harden_system_ownership.sh << 'EOF' #!/bin/bash echo "Hardening system ownership..." # 修复关键系统文件所有权 chown root:root /etc/passwd chown root:root /etc/shadow chown root:root /etc/group chown root:root /etc/gshadow chown root:root /etc/ssh/sshd_config chown root:root /etc/ssh/ssh_config # 修复系统目录所有权 chown root:root /bin /sbin /usr/bin /usr/sbin chown root:root /etc /var /usr # 修复日志目录所有权 chown root:root /var/log find /var/log -type f -exec chown root:root {} \; # 修复临时目录所有权 chown root:root /tmp /var/tmp echo "System ownership hardened" EOF # 2. 检查并修复所有权问题 # cat > /tmp/check_fix_ownership.sh << 'EOF' #!/bin/bash # 检查无主文件 echo "Checking for unowned files..." find /home -nouser -o -nogroup | while read file; do echo "Fixing ownership for $file" chown root:root "$file" done # 检查系统文件所有权 echo "Checking system file ownership..." for file in /etc/passwd /etc/shadow /etc/group /etc/gshadow; do owner=$(stat -c "%U:%G" $file) if [ "$owner" != "root:root" ]; then echo "Fixing ownership for $file" chown root:root $file fi done echo "Ownership check completed" EOF # 3. 应用安全所有权模板 # cat > /tmp/apply_security_ownership.sh << 'EOF' #!/bin/bash # 定义安全所有权模板 declare -A OWNERSHIP=( ["/etc/passwd"]="root:root" ["/etc/shadow"]="root:root" ["/etc/group"]="root:root" ["/etc/gshadow"]="root:root" ["/etc/ssh/sshd_config"]="root:root" ["/etc/ssh/ssh_config"]="root:root" ["/etc/crontab"]="root:root" ["/etc/cron.d"]="root:root" ) for file in "${!OWNERSHIP[@]}"; do if [ -e "$file" ]; then chown ${OWNERSHIP[$file]} "$file" echo "Set ${OWNERSHIP[$file]} on $file" fi done echo "Security ownership template applied" EOF # 4. 所有权审计和修复 # cat > /tmp/audit_fix_ownership.sh << 'EOF' #!/bin/bash REPORT="/tmp/ownership_audit_fix.txt" echo "Ownership Audit and Fix - $(date)" > $REPORT

# 检查并修复无主文件
echo “” >> $REPORT
echo “Fixing unowned files…” >> $REPORT
find /home -nouser -ls >> $REPORT
find /home -nouser -exec chown root:root {} \;

# 检查并修复无组文件
echo “” >> $REPORT
echo “Fixing ungrouped files…” >> $REPORT
find /home -nogroup -ls >> $REPORT
find /home -nogroup -exec chgrp root {} \;

# 检查系统文件所有权
echo “” >> $REPORT
echo “Checking system file ownership…” >> $REPORT
for file in /etc/passwd /etc/shadow /etc/group /etc/gshadow; do
owner=$(stat -c “%U:%G” $file)
echo “$file: $owner” >> $REPORT
if [ “$owner” != “root:root” ]; then
chown root:root $file
echo “Fixed $file” >> $REPORT
fi
done

echo “Audit and fix completed. Report saved to $REPORT”
EOF

# 5. 完整所有权安全加固
# cat > /tmp/full_ownership_hardening.sh << 'EOF' #!/bin/bash echo "Starting full ownership hardening..." # 1. 系统文件所有权加固 ./harden_system_ownership.sh # 2. 检查并修复所有权问题 ./check_fix_ownership.sh # 3. 应用安全模板 ./apply_security_ownership.sh # 4. 所有权审计和修复 ./audit_fix_ownership.sh echo "Full ownership hardening completed" EOF # chmod +x /tmp/full_ownership_hardening.sh # /tmp/full_ownership_hardening.sh

# 案例1：用户无法访问文件
# 症状：用户提示”Permission denied”

# 排查步骤：
# 1. 检查文件所有权
# ls -l file.txt
-rw——-. 1 root root 1234 Apr 2 10:00 file.txt

# 2. 检查用户身份
# id username
uid=1000(username) gid=1000(username) groups=1000(username)

# 解决：修改文件所有权或权限
# chown username:username file.txt
# 或
# chmod 644 file.txt

# 案例2：用户无法修改文件
# 症状：用户提示”Permission denied”

# 排查步骤：
# 1. 检查文件所有权
# ls -l file.txt
-rw-r–r–. 1 root root 1234 Apr 2 10:00 file.txt

# 2. 检查文件权限
# stat -c “%a” file.txt
644

# 解决：修改文件所有权或权限
# chown username:username file.txt
# 或
# chmod 664 file.txt

# 案例3：用户无法访问目录
# 症状：用户提示”Permission denied”

# 排查步骤：
# 1. 检查目录所有权
# ls -ld /app/data
drwxr-x—. 2 root app 4096 Apr 2 10:00 /app/data

# 2. 检查用户组
# id username
uid=1000(username) gid=1000(username) groups=1000(username)

# 解决：修改目录所有权或添加用户到组
# chown username:app /app/data
# 或
# gpasswd -a username app

# 案例4：文件所有权异常
# 症状：文件所有者显示为数字

# 排查步骤：
# 1. 检查文件所有权
# ls -l file.txt
-rw-r–r–. 1 1234 5678 1234 Apr 2 10:00 file.txt

# 2. 检查用户是否存在
# id 1234
id: ‘1234’: no such user

# 解决：修复文件所有权
# chown root:root file.txt

# 案例5：无主文件问题
# 症状：文件没有所有者

# 排查步骤：
# 1. 查找无主文件
# find /home -nouser -ls
1234567 4 -rw-r–r– 1 1234 5678 1234 Apr 2 10:00 /home/test/file.txt

# 解决：修复无主文件
# chown root:root /home/test/file.txt

# 案例6：所有权修改失败
# 症状：chown命令执行失败

# 排查步骤：
# 1. 检查用户权限
# id
uid=1000(username) gid=1000(username) groups=1000(username)

# 2. 检查文件系统
# mount | grep “on / ”
/dev/mapper/rhel-root on / type xfs (rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota)

# 解决：使用root权限
# su –
# chown username:username file.txt

# 案例7：符号链接所有权问题
# 症状：符号链接所有权不正确

# 排查步骤：
# 1. 检查符号链接
# ls -l link.txt
lrwxrwxrwx. 1 root root 8 Apr 2 10:00 link.txt -> file.txt

# 解决：修改符号链接所有权
# chown -h username:username link.txt

# 案例8：所有权继承问题
# 症状：新文件不继承目录所有权

# 排查步骤：
# 1. 检查目录所有权
# ls -ld /shared
drwxrwsr-x. 2 root developers 4096 Apr 2 10:00 /shared

# 2. 检查新文件所有权
# touch /shared/test.txt
# ls -l /shared/test.txt
-rw-r–r–. 1 username username 0 Apr 2 10:00 /shared/test.txt

# 解决：SGID只继承组，不继承所有者
# 使用umask或脚本设置所有权

# 案例9：所有权变更监控
# 症状：文件所有权被意外修改

# 排查步骤：
# 1. 检查审计日志
# ausearch -k ownership_changes

# 2. 检查系统日志
# journalctl -xe | grep chown

# 解决：启用审计监控
# auditctl -w /etc/passwd -p a -k ownership_changes

# 案例10：所有权备份恢复
# 症状：需要恢复文件所有权

# 排查步骤：
# 1. 检查所有权备份
# cat /tmp/app_ownership.txt
/app/bin app:app
/app/conf app:app

# 解决：恢复所有权
# cat /tmp/app_ownership.txt | while read file owner; do
chown $owner $file
done