Tool

chguard

Snapshot and restore filesystem ownership & permissions.

Install Repo
Safety boundaries
  • Never creates, deletes, or moves files
  • Missing files are ignored; new files are ignored
  • Symbolic links are skipped entirely
  • Does not manage ACLs/xattrs or file content undo
  • Requires sudo only when necessary; never auto-escalates
chguard logo

Quickstart

chguard --save /srv/app --name app-baseline
chguard --list
chguard --restore app-baseline
chguard --restore app-baseline --dry-run
chguard --restore app-baseline --permissions
chguard --restore app-baseline --owner
chguard -- chown user:group /srv/app/config.yml

Key features

Snapshot metadata
Records numeric uid/gid and mode for files and directories.
Preview diffs
Always shows a readable table of what would change.
Scope control
Restore both, owner-only, or perms-only.

How it works

Step 1
Save a snapshot
Capture ownership and permission metadata into a local SQLite DB.
Step 2
Preview restore
See the diff table and verify the intended changes.
Step 3
Confirm and apply
One prompt at the end; default is No.

Wrapper mode

Use -- to wrap a metadata-changing command. chguard auto-snapshots first (auto-YYYYMMDD-HHMMSS).

chguard -- chmod 755 /srv/app/bin/start
chguard -- chown app:app /srv/app/config.yml
Supported commands: chmod, chown, chgrp.
TIP: Alias the chguard wrapper mode for convenience.

Reference & examples

Everything for this tool on one page: options, behaviour notes, and copy-paste examples.

Privilege model

Principle: never auto-escalate

chguard does not run sudo internally. If you need privileges, run it with sudo explicitly.

When sudo is required

  • Save fails if root-owned files are present and you’re not root.
  • Restore fails if the changes require elevated privileges.
  • Preview / dry-run never require sudo.

Practical tip

# take snapshot as root when the tree includes root-owned files
sudo chguard --save /srv/app --name app-baseline

Storage model

What’s stored

Snapshots are stored in a local SQLite database containing:

  • relative path
  • file type (file or directory)
  • numeric uid / gid
  • numeric mode

Usernames and permission strings are resolved only for display.

Usage & options

Save a snapshot

Record uid/gid and mode for files and directories under a path.

chguard --save /srv/app --name app-baseline
If root-owned files are present, saving requires sudo.

List snapshots

chguard --list

Output includes snapshot name, path, and timestamp.

Restore (preview + confirm)

Restore always previews a diff table first, then prompts once at the end (default No).

chguard --restore app-baseline

Restore scope control

Choose what kind of metadata to restore.

chguard --restore app-baseline              # owner + perms (default)
chguard --restore app-baseline --permissions
chguard --restore app-baseline --owner

Dry-run

chguard --restore app-baseline --dry-run