paste.script.checkperms – functions to check and diff file permissions

This is a module to check the filesystem for the presence and permissions of certain files. It can also be used to correct the permissions (but not existance) of those files.

Currently only supports Posix systems (with Posixy permissions). Permission stuff can probably be stubbed out later.

Contents

Module Contents

Permissions

paste.script.checkperms.read_perm_spec(spec)

Reads a spec like ‘rw-r–r–’ into a octal number suitable for chmod. That is characters in groups of three – first group is user, second for group, third for other (all other people). The characters are r (read), w (write), and x (executable), though the executable can also be s (sticky). Files in sticky directories get the directories permission setting.

Examples:

>>> print oct(read_perm_spec('rw-r--r--'))
0644
>>> print oct(read_perm_spec('rw-rwsr--'))
02664
>>> print oct(read_perm_spec('r-xr--r--'))
0544
>>> print oct(read_perm_spec('r--------'))
0400
paste.script.checkperms.mode_diff(filename, mode, **kw)

Returns the differences calculated using calc_mode_diff

paste.script.checkperms.calc_mode_diff(cur_mode, mode, keep_exe=True, not_set='not set: ', set='set: ')

Gives the difference between the actual mode of the file and the given mode. If keep_exe is true, then if the mode doesn’t include any executable information the executable information will simply be ignored. High bits are also always ignored (except suid/sgid and sticky bit).

Returns a list of differences (empty list if no differences)

paste.script.checkperms.calc_set_mode(cur_mode, mode, keep_exe=True)

Calculates the new mode given the current node cur_mode and the mode spec mode and if keep_exe is true then also keep the executable bits in cur_mode if mode has no executable bits in it. Return the new mode.

Examples:

>>> print oct(calc_set_mode(0775, 0644))
0755
>>> print oct(calc_set_mode(0775, 0744))
0744
>>> print oct(calc_set_mode(010600, 0644))
010644
>>> print oct(calc_set_mode(0775, 0644, False))
0644
paste.script.checkperms.set_mode(filename, mode, **kw)

Sets the mode on filename using calc_set_mode

Ownership

paste.script.checkperms.calc_ownership_spec(spec)

Calculates what a string spec means, returning (uid, username, gid, groupname), where there can be None values meaning no preference.

The spec is a string like owner:group. It may use numbers instead of user/group names. It may leave out :group. It may use ‘-‘ to mean any-user/any-group.

paste.script.checkperms.ownership_diff(filename, spec)

Return a list of differences between the ownership of filename and the spec given.

paste.script.checkperms.set_ownership(filename, spec)

Set the ownership of filename given the spec.

Models

class paste.script.checkperms.PermissionSpec

Represents a set of specifications for permissions.

Typically reads from a file that looks like this:

rwxrwxrwx user:group filename

If the filename ends in /, then it expected to be a directory, and the directory is made executable automatically, and the contents of the directory are given the same permission (recursively). By default the executable bit on files is left as-is, unless the permissions specifically say it should be on in some way.

You can use ‘nomodify filename’ for permissions to say that any permission is okay, and permissions should not be changed.

Use ‘noexist filename’ to say that a specific file should not exist.

Use ‘symlink filename symlinked_to’ to assert a symlink destination

The entire file is read, and most specific rules are used for each file (i.e., a rule for a subdirectory overrides the rule for a superdirectory). Order does not matter.

Table Of Contents

This Page