Root directory '/' locked after using chmod

Question

I accidentally used

sudo chmod 3 /

which gives a execute and write permission to the root directory, while deleting the read permission. How can I recover from this, I cannot even use sudo now.

Solution 1

First, try other suggestions while still logged in, because mine requires a reboot. If you see that no other attempt works, you should reboot and start a live DVD/USB session.

Mount the root partition and edit the /etc/fstab as root. You will need to run a command similar to this:

gksu gedit /media/ubuntu/sda1/etc/fstab

Please adjust the path to the correct mount point you used.

In the file, locate the line belonging to the root partition, it should look similar to the following:

UUID=[...] /               ext4    errors=remount-ro 0       1

Try to enforce "universal" permissions by adding the proper parameter:

UUID=[...] /               ext4    umask=000,errors=remount-ro 0       1

Reboot and try to log in again. You should be able to fix the permissions with:

sudo chmod 755 /

Warning

After the fix, remember to revert the changes made to /etc/fstab, otherwise anyone will be able to access and modify every system file.

Solution 2

As you can't use sudo, try the following command instead (you'll get root privileges with pkexec):

pkexec chmod 755 /

Tested ok in a VM:

u@u-VirtualBox:/$ sudo chmod 3 /
[sudo] password for u: 
u@u-VirtualBox:/$ ll
ls: cannot open directory .: Permission denied
u@u-VirtualBox:/$ sudo chmod 755 /
sudo: unable to stat /etc/sudoers: No such file or directory
sudo: no valid sudoers sources found, quitting
sudo: unable to initialize policy plugin
u@u-VirtualBox:/$ pkexec chmod 755 /
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/bin/chmod' as the super user
Authenticating as: u,,, (u)
Password: 
==== AUTHENTICATION COMPLETE ===
u@u-VirtualBox:/$ ll
total 104
drwxr-xr-x  23 root root  4096 oct.  12 20:22 ./
drwxr-xr-x  23 root root  4096 oct.  12 20:22 ../
[...]
u@u-VirtualBox:/$ 

Comments

[DevSolar]

Regarding "unable to sudo", if all else fails and you have the access and knowledge to tinker with the boot loader, add init=/bin/bash to the kernel line. That makes the machine boot directly into a bash with root priviledges, enabling you to fix blunders like these, and others. Corollary: If Mallory gets access to the boot process, your system security is shot. ;-)

[Andrea Lazzarotto]

I guess he can't run any other executable, since they are all under /.

[Sylvain Pineau]

@AndreaLazzarotto: I tested OP command in a VM, pkexec restored the initial permissions on /. See my logs.

[Andrea Lazzarotto]

Thanks for updating your answer. Now that it's verified to work, I think it's far better than mine. :D

[muru]

@AndreaLazzarotto OP was lucky that it was chmod 3, and not chmod 2 or chmod 4.

[John WH Smith]

Wouldn't it be easier to just fix the / permissions from the Live DVD? After all, if you use a Linux live, you'll probably be able to manipulate the mounted filesystem without trouble.

[Joshua]

since when does umask work on ext4?

[Andrea Lazzarotto]

@muru, you are right. I corrected the mistake. @John WH Smith, probably that's possible as well. I wasn't sure how to do it so I wrote my answer this way. @Joshua, there is nothing in man umask which excludes ext4. Is this limitation documented somewhere?