If several services suddenly stop starting at once, and in the console you see messages like "must be owned by root and not group or world-writable" or "you are attempting to log to a world writable directory" or other errors that mention the keyword "world-writable", and probably also paths like "/var/log", "/var/run" and similar - know that there are permission issues on these directories.
The thing is, daemons won't start and can't write logs if simple security rules aren't followed, among them permissions on log directories and service folders.
"World-writable" means that anyone can write to that file or folder. In other words, its attributes could be written as rwxrwxrwx. This is unacceptable for applications working with the /var/log and /var/run directories, and probably some others as well.
This error, for the most part, can happen because of incorrect actions by some system administrator who assigned overly broad permissions to critical directories.
You'll have to fix all this by hand - assigning the necessary permissions to the directories and files. The best method is to check a neighboring server, if you have one, to see what numeric permissions are set on the affected folders. For example, if the permissions on /var are wrong on your system - check what permissions are set on a working server and set the same ones.
How to view permissions (chmod) for files and directories in numeric form (i.e. like ls, but with numeric chmod permissions) was covered earlier
Here's an example of how permissions are laid out on the /var directory in Linux Debian:
$ cd /var
$ stat -c '%a %n' *
755 backups
755 cache
755 chroot
755 lib
2775 local
1777 lock
755 log
2775 mail
755 opt
755 run
755 spool
1777 tmp
755 www
And here it is for CentOS/RedHat (though our mischievous hands have already poked around in it) for /var:
755 account
755 cache
755 db
755 empty
755 ftp
755 games
755 lib
755 local
775 lock
755 log
777 mail
755 nis
755 opt
755 preserve
755 racoon
755 run
755 spool
1777 tmp
755 www
755 yp
Obviously I can't give examples of permissions for everything here - you'll have to check for yourself. Remember one rule: write permission for "EVERYONE" needs to be removed everywhere in critical directories (i.e. there should be no rwx in the "EVERYONE" slot - it should never be rwxrwxrwx; something like rwxr-xr-x or even rwxr-x--- is fine).
Comments