Default user-group owner for /var folder

/var/ is probably the most complicated ownership setup in the entire operating system. It's not all root-owned and doing that is about as harmful as letting your user own it all. Some things won't work if you leave it like that, namely the desktop.

If you want to see the array of users and owners you're dealing with, look at the following command on a working system:

sudo ls -lR /var | awk '/^[^/]/ {print $3 " " $4}' | sort -u

On my system, 59 distinct user/owner combinations in /var/. This is the point where I expect most people give up and reinstall. Let's be honest, if you haven't gone that far with your computer, there isn't going to be much lost from a nice install-over-the-top. It's almost certainly going to be quicker.

If you're still reading, you're completely mad but you're in good company. Let's start by owning everything to root:root.

sudo chown -R root: /var

And now we have to correct for the things that aren't and can't be root. I have written short command that shows me the files and directories that aren't owned by root:root.

In the output I have trimmed out some things that aren't going to be relevant to a lot of people (nginx, rabbitmq, schroot stuff, lxc, and a lot more). This is all specialist stuff. If you've borked those permissions, ask me for the output and I'll include it. I have also broken down some big directories that are owned by the same user/group all the way through with wildcards.

I'm including this output so you can see how things are supposed to be owned. You can manually chown things to approximately the right user/group. oli is my $USER.

$ sudo find /var/ -not \( -user 0 -group 0 \) -not -path "/var/lib/schroot/*" -not -path "/var/cache/*" -not -path "/var/tmp/*" -printf "%p,%u:%g\n" | grep -viE "(squeeze|rabbitmq|nginx|lxc|postfix)" | sort -u | column -t -c 80 -s ,
/var/backups/gshadow.bak                                     root:shadow
/var/backups/shadow.bak                                      root:shadow
/var/crash/*                                                 root:whoopsie
/var/lib/avahi-autoipd/6c:f0:49:54:0b:80                     avahi-autoipd:avahi-autoipd
/var/lib/avahi-autoipd                                       avahi-autoipd:avahi-autoipd
/var/lib/colord/*                                            colord:colord
/var/lib/libuuid                                             libuuid:libuuid
/var/lib/mlocate/mlocate.db                                  root:mlocate
/var/lib/nfs/sm.bak                                          statd:nogroup
/var/lib/nfs/sm                                              statd:nogroup
/var/lib/nfs                                                 statd:nogroup
/var/lib/nfs/state                                           statd:root
/var/lib/samba/usershares/films                              oli:oli
/var/lib/samba/usershares/incoming                           oli:oli
/var/lib/samba/usershares                                    root:sambashare
/var/lib/samba/usershares/tv                                 oli:oli
/var/lib/sudo/oli/0                                          root:oli
/var/lib/sudo/oli/10                                         root:oli
/var/lib/sudo/oli/11                                         root:oli
/var/lib/sudo/oli/12                                         root:oli
/var/lib/sudo/oli/13                                         root:oli
/var/lib/sudo/oli/14                                         root:oli
/var/lib/sudo/oli/1                                          root:oli
/var/lib/sudo/oli/2                                          root:oli
/var/lib/sudo/oli/3                                          root:oli
/var/lib/sudo/oli/4                                          root:oli
/var/lib/sudo/oli/5                                          root:oli
/var/lib/sudo/oli/6                                          root:oli
/var/lib/sudo/oli/7                                          root:oli
/var/lib/sudo/oli/8                                          root:oli
/var/lib/sudo/oli/9                                          root:oli
/var/lib/sudo/oli/console                                    root:oli
/var/lib/sudo/oli                                            root:oli
/var/lib/sudo/oli/tty1                                       root:oli
/var/lib/sudo/oli/tty2                                       root:oli
/var/lib/lightdm/*                                           lightdm:lightdm
/var/local                                                   root:staff
/var/log/apport.log.1                                        root:adm
/var/log/apport.log.2.gz                                     root:adm
/var/log/apport.log.3.gz                                     root:adm
/var/log/apport.log.4.gz                                     root:adm
/var/log/apport.log.5.gz                                     root:adm
/var/log/apport.log.6.gz                                     root:adm
/var/log/apport.log.7.gz                                     root:adm
/var/log/apport.log                                          root:adm
/var/log/apt/term.log.1.gz                                   root:adm
/var/log/apt/term.log.2.gz                                   root:adm
/var/log/apt/term.log.3.gz                                   root:adm
/var/log/apt/term.log.4.gz                                   root:adm
/var/log/apt/term.log.5.gz                                   root:adm
/var/log/apt/term.log.6.gz                                   root:adm
/var/log/apt/term.log.7.gz                                   root:adm
/var/log/apt/term.log                                        root:adm
/var/log/auth.log.1                                          syslog:adm
/var/log/auth.log.2.gz                                       syslog:adm
/var/log/auth.log.3.gz                                       syslog:adm
/var/log/auth.log.4.gz                                       syslog:adm
/var/log/auth.log                                            syslog:adm
/var/log/boot                                                root:adm
/var/log/btmp.1                                              root:utmp
/var/log/btmp                                                root:utmp
/var/log/cups/access_log.1.gz                                root:adm
/var/log/cups/access_log.2.gz                                root:adm
/var/log/cups/access_log.3.gz                                root:adm
/var/log/cups/access_log.4.gz                                root:adm
/var/log/cups/access_log.5.gz                                root:adm
/var/log/cups/access_log.6.gz                                root:adm
/var/log/cups/access_log.7.gz                                root:adm
/var/log/cups/access_log                                     root:adm
/var/log/cups/error_log.1.gz                                 root:adm
/var/log/cups/error_log.2.gz                                 root:adm
/var/log/cups/error_log.3.gz                                 root:adm
/var/log/cups/error_log.4.gz                                 root:adm
/var/log/cups/error_log.5.gz                                 root:adm
/var/log/cups/error_log.6.gz                                 root:adm
/var/log/cups/error_log.7.gz                                 root:adm
/var/log/cups/error_log                                      root:adm
/var/log/cups/page_log.1.gz                                  root:adm
/var/log/cups/page_log.2.gz                                  root:adm
/var/log/cups/page_log.3.gz                                  root:adm
/var/log/cups/page_log.4.gz                                  root:adm
/var/log/cups/page_log.5.gz                                  root:adm
/var/log/cups/page_log.6.gz                                  root:adm
/var/log/cups/page_log.7.gz                                  root:lpadmin
/var/log/cups/page_log                                       root:adm
/var/log/cups                                                root:lpadmin
/var/log/dist-upgrade/20121107-0129/apt-term.log             root:adm
/var/log/dist-upgrade/20130426-1402/apt-term.log             root:adm
/var/log/dist-upgrade/apt-term.log                           root:adm
/var/log/dmesg.0                                             root:adm
/var/log/dmesg.1.gz                                          root:adm
/var/log/dmesg.2.gz                                          root:adm
/var/log/dmesg.3.gz                                          root:adm
/var/log/dmesg.4.gz                                          root:adm
/var/log/dmesg                                               root:adm
/var/log/fail2ban.log.1                                      root:adm
/var/log/fail2ban.log.2.gz                                   root:adm
/var/log/fail2ban.log.3.gz                                   root:adm
/var/log/fail2ban.log.4.gz                                   root:adm
/var/log/fail2ban.log                                        root:adm
/var/log/fsck/checkfs                                        root:adm
/var/log/fsck/checkroot                                      root:adm
/var/log/hp/hp-upgrade.log                                   oli:oli
/var/log/hp                                                  root:lp
/var/log/hp/tmp                                              root:lp
/var/log/installer/syslog                                    syslog:adm
/var/log/kern.log.1                                          syslog:adm
/var/log/kern.log.2.gz                                       syslog:adm
/var/log/kern.log.3.gz                                       syslog:adm
/var/log/kern.log.4.gz                                       syslog:adm
/var/log/kern.log                                            syslog:adm
/var/log/lastlog                                             root:utmp
/var/log/mail.err.1                                          syslog:adm
/var/log/mail.err.2.gz                                       syslog:adm
/var/log/mail.err.3.gz                                       syslog:adm
/var/log/mail.err.4.gz                                       syslog:adm
/var/log/mail.err                                            syslog:adm
/var/log/mail.log.1                                          syslog:adm
/var/log/mail.log.2.gz                                       syslog:adm
/var/log/mail.log.3.gz                                       syslog:adm
/var/log/mail.log.4.gz                                       syslog:adm
/var/log/mail.log                                            syslog:adm
/var/log/news/news.crit                                      syslog:adm
/var/log/news/news.err                                       syslog:adm
/var/log/news/news.notice                                    syslog:adm
/var/log/speech-dispatcher                                   speech-dispatcher:root
/var/log/syslog.1                                            syslog:adm
/var/log/syslog.2.gz                                         syslog:adm
/var/log/syslog.3.gz                                         syslog:adm
/var/log/syslog.4.gz                                         syslog:adm
/var/log/syslog.5.gz                                         syslog:adm
/var/log/syslog.6.gz                                         syslog:adm
/var/log/syslog.7.gz                                         syslog:adm
/var/log/syslog                                              syslog:adm
/var/log/ufw.log.1                                           syslog:adm
/var/log/ufw.log                                             syslog:adm
/var/log/wtmp.1                                              root:utmp
/var/log/wtmp                                                root:utmp
/var/mail/oli                                                oli:mail
/var/mail                                                    root:mail
/var/mail/root                                               root:mail
/var/metrics                                                 root:whoopsie
/var/spool/cron/atjobs/a000020152342b                        oli:daemon
/var/spool/cron/atjobs                                       daemon:daemon
/var/spool/cron/atjobs/.SEQ                                  daemon:daemon
/var/spool/cron/atspool                                      daemon:daemon
/var/spool/cron/crontabs/oli                                 oli:crontab
/var/spool/cron/crontabs                                     root:crontab
/var/spool/cups/c00075                                       root:lp
/var/spool/cups/c00076                                       root:lp
/var/spool/cups/c00077                                       root:lp
/var/spool/cups/c00078                                       root:lp
/var/spool/cups/d00075-001                                   root:lp
/var/spool/cups/d00076-001                                   root:lp
/var/spool/cups/d00077-001                                   root:lp
/var/spool/cups/d00078-001                                   root:lp
/var/spool/cups                                              root:lp
/var/spool/cups/tmp                                          root:lp
/var/spool/rsyslog                                           syslog:adm