PERMCTL(8)

📦 version 1699_20250120, in opensuse-leap 16.0

💅 PERMCTL(8) — the chkstat glow-up, bestie

okay so picture this: a whole manual page for permctl, from section 8 (system admin commands, iykyk). yes we're doing system-wide file permissions today and honestly? it's giving main character energy. let's go 🎀

🌸 NAME 🌸

permctl — the tool that checks and sets system wide file permissions ✨

🦋 SYNOPSIS 🦋

permctl [OPTIONS] <permission-files...>

permctl --system [OPTIONS] <files...>

like, two whole modes. pick your fighter 💖

🌈 DESCRIPTION 🌈

The program /usr/bin/permctl is a tool to check and set file permissions. It was previously called chkstat, but it's been renamed to better describe its purpose. glow-up era fr fr — same icon, better name 💅

permctl can either operate in system mode or on individually specified permission files. In system mode, the file /etc/sysconfig/security determines which profile to use and whether to actually apply permission changes. so it's lowkey the boss of the vibe check 👑

✨ OPTIONS ✨

  • --system — Run in system mode. Parses /etc/sysconfig/security to figure out which profile / security level to use (PERMISSION_SECURITY) and whether to set or merely warn about permission changes (CHECK_PERMISSIONS). In system mode, any non-option arguments limit the set of files to operate on — i.e. just as if the --examine option was specified for them. so extra args = a subtle little filter, no cap 🫶
  • --set — Actually apply the file permissions. The default is to check and warn only, unless in system mode, where CHECK_PERMISSIONS specifies the default behavior. so like, this is the "do it for real" button 🔥
  • --warn — Opposite of --set, i.e. warn only, but don't make actual changes. all talk, no action, respectfully 🙈
  • --noheader — Omit printing the output header lines which describe the configuration files used by permctl. bye bye intro text 💀
  • --fscaps, --no-fscaps — Enable or disable use of file based capabilities. In system mode the setting of PERMISSIONS_FSCAPS determines whether capabilities are applied, when this option is not set. toggle toggle 🧚
  • --examine <file...> — Check permissions for this file instead of all files listed in the permissions files. Can appear multiple times. very "just this one, bestie" 💜
  • --files <filelist...> — Check permissions for the files listed in filelist instead of all files listed in the permissions files. Can appear multiple times. The files must contain the file paths to check, one per line. a lil list of lists, we love recursion-adjacent behavior 🍓
  • --root <directory> — Check files relative to the specified directory. home base relocation ✨

🧚 ENVIRONMENT VARIABLES 🧚

  • PERMCTL_ALLOW_INSECURE_MODE_IF_NO_PROC — Allow to operate without mounted /proc file system. This is an unsafe mode that must only be used in controlled environments where unprivileged users can't influence file system operation. ⚠️ okay so this one is the "please be careful" one, fr fr — don't just turn it on because it looks fun.
seriously bestie, that env var is a red-flag-coded permission slip. controlled environments only. 💀

⭐ EXIT STATUS ⭐

permctl returns 1 if any fatal errors have been encountered that prevented it from determining or adjusting file permissions. It returns 2 if --warn was given and one or more entries need fixing. In all other cases it returns 0.

so like: 1 = something broke 😭, 2 = you asked to warn and yes there's stuff to fix 👀, 0 = we're so back 🌸

🎀 EXAMPLES 🎀

permctl --set /usr/share/permissions/permissions /usr/share/permissions/permissions.secure

Parses the supplied permission configuration files and applies the permission settings for all files listed there. this is the "actually do the thing" run 🔥

permctl --system /usr/bin/ping

Run in system mode and only correct permissions of /usr/bin/ping. ping gets special treatment, as it should 👑

💖 SEE ALSO 💖

  • permissions(5) — go read that one too, bestie, it's the whole context ✨
1996-2003 SuSE Linux AG, Nuernberg, Germany.
2008-2019 SUSE LINUX Products GmbH
2019-2024 SUSE Software Solutions Germany GmbH

🌸 AUTHORS 🌸

Reinhold Sojer, Ruediger Oertel, Michael Schroeder, Ludwig Nussel

Useful changes and additions by Tobias Burnus

Major refactoring by Matthias Gerstner, Malte Kraus

okay that's the whole page!! and for the cute sign-off: this beauty is from the 05/22/2024 edition of the PERMCTL(8) manual — so it's serving you the freshest 2024-era permissions lore 🦋💅 periodt.

📦 where this page comes from