secaudit displays the ownership and permissions of a set of files on an NTFS file system, and checks their consistency. It can be started in terminal mode only (no graphical user interface is available) either on Linux or on Windows.

The available options are not the same in Linux and Windows, but in both cases, you issue in a terminal window a command such as :

ntfs-3g.secaudit [options] args
(or secaudit [options] args on Windows)

Where options is a combination of :

-a full auditing of security data (Linux only)
-b backup ACLs
-e setting extra backed-up parameters (in conjunction with -s)
-h displaying hexadecimal security descriptors saved in a file
-r recursing in a directory
-s setting backed-up ACLs
-v verbose (very verbose if set twice)

and args define the parameters and the set of files acted upon.

Typing ntfs-3g.secaudit with no args will display a summary of available options.

When acting on a directory or volume, the command may produce a lot of information. It is therefore advisable to redirect the output to a file or pipe it to a text editor for examination.

Windows version

The source and executable for Windows are included in tools.zip. They do not require ntfs-3g to be installed.

On Windows files and directories designate (implicitly or explicitly) the volume they belong to. Hence the command has no argument to designate the volume. A single file or directory may be acted upon (wildcards not supported) and if its name has spaces or special characters, it has to be enclosed in quotes.

The valid combinations of options and args are :

  • secaudit -h file

displays in an human readable form the hexadecimal security descriptors saved in file. This can be used to turn a verbose output into a very verbose output.

  • secaudit [-v] file

displays the security parameters of file : its interpreted Linux mode (rwx flags in octal) and Posix ACL[1], and its security descriptor if verbose output.

  • secaudit -r[v] directory

displays the security parameters of all files and subdirectories in directory : their interpreted Linux modes (rwx flags in octal) and Posix ACLs[1], and their security descriptor if verbose output.

  • secaudit -b[v] directory

recursively extracts to standard output the NTFS ACLs of files in directory.

  • secaudit -s[ev] [backup-file]

sets the NTFS ACLs as indicated in backup-file or standard input. The input data must have been created on Windows. This is best run as an administrator as the current ACL may forbid ACL changes.
With option -e, also sets extra parameters (currently Windows attrib).

  • secaudit perms file

sets the security parameters of file to perms. Perms is the Linux requested mode (rwx flags, expressed in octal form as in chmod), or a Posix ACL[1] (expressed like in setfacl -m). It sets a new NTFS ACL which is effective for Linux and Windows.

  • secaudit -r[v] perms directory

sets the security parameters of all files and subdirectories in directory to perms. Perms is the Linux requested mode (rwx flags, expressed in octal form as in chmod), or a Posix ACL[1] expressed like in setfacl -m). This sets new ACLs which are effective for Linux and Windows.

Linux version

The source is included in tools.zip, and the executable is installed as part of the ntfs-3g package. Its execution requires the full package to be installed.

On Linux the NTFS partition has to be unmounted, so the command has an argument to designate the volume, and the file or directory designation has to be relative to the root of the NTFS partition. A single file or directory may be acted upon (wildcards must resolve to a single name), and if its name has spaces or special characters, it has to be enclosed in quotes.

Moreover the command has to be issued as root.

The valid combinations of options and args are :

  • ntfs-3g.secaudit -h file

displays in an human readable form the hexadecimal security descriptors saved in file. This can be used to turn a verbose output into a very verbose output.

  • ntfs-3g.secaudit -a[rv] volume

audits the volume : all the global security data on volume are scanned and errors are displayed. If option -r is present, all files and directories are also scanned and their relations to global security data are checked. This can produce a lot of data.

This option is not effective on volumes formatted for old NTFS versions (pre NTFS 3.0). Such volumes have no global security data.

When errors are signalled, it is advisable to repair the volume with an appropriate tool (such as chkdsk on Windows.)

  • ntfs-3g.secaudit [-v] volume file

displays the security parameters of file : its interpreted Linux mode (rwx flags in octal) and Posix ACL[1], its security key if any, and its security descriptor if verbose output.

  • ntfs-3g.secaudit -r[v] volume directory

displays the security parameters of all files and subdirectories in directory : their interpreted Linux mode (rwx flags in octal) and Posix ACL[1], their security key if any, and their security descriptor if verbose output.

  • ntfs-3g.secaudit -b[v] volume [directory]

recursively extracts to standard output the NTFS ACLs of files in directory.

  • ntfs-3g.secaudit -s[ev] volume [backup-file]

sets the NTFS ACLS as indicated in backup-file or standard input. The input data must have been created on Linux.
With option -e, also sets extra parameters (currently Windows attrib).

  • ntfs-3g.secaudit volume perms file

sets the security parameters of file to perms. Perms is the Linux requested mode (rwx flags, expressed in octal form as in chmod) or a Posix ACL[1] (expressed like in setfacl -m). This sets a new ACL which is effective for Linux and Windows.

  • ntfs-3g.secaudit -r[v] volume perms directory

sets the security parameters of all files and subdirectories in directory to perms. Perms is the Linux requested mode (rwx flags, expressed in octal form as in chmod), or a Posix ACL[1] (expressed like in setfacl -m). This sets new ACLs which are effective for Linux and Windows.

  • ntfs-3g.secaudit [-v] mounted-file

displays the security parameters of mounted-file : its interpreted Linux mode (rwx flags in octal) and Posix ACL[1], its security key if any, and its security descriptor if verbose output. This is a special case which acts on a mounted file (or directory) and does not require being root. The Posix ACL interpretation can only be displayed if the full path to mounted-file from the root of the global file tree is provided

Note

[1] provided the POSIX ACL option was selected at compile time. A Posix ACL specification looks like “[d:]{ugmo}:[id]:[perms],…” where id is a numeric user or group id, and perms an octal digit or a set from the letters r, w and x. Example : “u::7,g::5,o:0,u:510:rwx,g:500:5,d:u:510:7”


This page is maintained by Jean-Pierre André