How to fix '[: too many arguments' for jpg files [duplicate] - linux

This question already has answers here:
Meaning of "[: too many arguments" error from if [] (square brackets)
(6 answers)
Closed 3 years ago.
I am making a script that should play any media files in the downloads folder and shred it if I do not want to keep them. It works on the file types .swf, .webm, .gif, .png but not .jpg. For jpg I get this error
'[: too many arguments'
If I change it to .png without changing anything else then it works.
I have tried to change it from *jpg to *png, and that works. Changing it back to *jpg, gods forbid that. I can't find anything on google that can help me with this.
#!/bin/bash
cd Downloads
get_files () {
for i in *.*; do
[ -f "$i" ] || break
echo "Playing '$i'"
if [ "$i" == *swf ]; then
./flashplayer $i
shred_file $i
elif [ "$i" == *webm ]; then
vlc $i
shred_file $i
elif [ "$i" == *gif ]; then
xdg-open $i
shred_file $i
elif [ "$i" == *jpg ]; then
xdg-open $i
shred_file $i
elif [ "$i" == *png ]; then
xdg-open $i
shred_file $i
fi
done
}
shred_file () {
echo ""
echo "Do you want to shred the file?"
read r
if [ "$r" == "y" ]; then
shred -uvz $1
else
echo keep
fi
}
get_files
I expect this script to be able to open .jpg files and any other file types defined in this script. I do not expect this error to occur at all

In Bash (and other POSIX shells), [ ... ] is not particularly magical; in fact, it can be implemented as a completely separate program, though in practice most shells do provide it as a builtin. (If you run type -a [, you'll most likely see that your system has both a builtin and a separate program.)
So the problem is that if your current directory contains files whose names end with jpg, such as foojpg and barjpg, then this command:
[ "$i" == *jpg ]
expands to something like this:
[ my.file == foojpg barjpg ]
which is obviously not what you want.
And even if you escaped the * to prevent the filename-expansion ([ "$i" == \*jpg ] or [ "$i" == '*jpg' ]), it still wouldn't do what you want, because [ ... ] doesn't support this sort of glob comparison.
Since you're specifically using Bash, your best bet is to use its special [[ ... ]] syntax, which is magical, and has special support for globs:
[[ "$i" == *jpg ]]
(And likewise for all of your other tests.)

bash will expand *jpg to all the file names which end 'jpg'. And so on for all the file suffixes. The '.jpg' test causes an error probably because there are a number of files that match *.jpg.
Better to test the suffix itself:
suffix=${i#*.} # if $i is file.jpg yields 'jpg'
And then do tests for the suffix value:
if [ "$suffix" == "swf" ]; then
./flashplayer $i
shred_file $i
elif [ "$suffix" == "webm" ]; then
vlc $i
shred_file $i
...
...
Incidentally, for the for loop, you could (if appropriate) specify the file types the loop should process:
shopt -s nullglob
for i in *.{swf,gif,png,jpg,jpeg}; do

Related

How to write an abbreviated version of the if record for this code?

How to write an abbreviated version of the if record for this code?
Rewrite the same script making it one-liner. (if else)
Linux RedHat 4-5
!/bin/bash
for file in /etc/*; do
if [ -f "$file" ]
then
echo "$file is a regular file"
elif [ -d "$file" ]
then
echo "$file is a directory"
else
echo "$file is something else"
fi
done
Rewrite the same script making it one-liner. (if else)
Not sure if this is better, but this will work:
([ -f "$file" ] && echo "regular") || ( [ -d "$file" ] && echo "dir" ) || echo "wtf"

How to implement tree command in bash/shell script?

I tried to implement in bash some code which output would be similar to the "tree" command in the terminal.
Here it is:
listContent() {
local file
for file in "$1"/*; do
if [ -d $file ]; then
countSpaces $file
echo $?"Directory: $file"
listContent "$file"
elif [ -f $file ]; then
countSpaces $file
echo $?"File: $file"
fi
done
}
countSpaces() {
local space=" "
for (( i=0; i<${#$1}; i++ )); do
if [ ${file:$i:1} = "/" ]; then
space = space + space
return space
done
}
listContent "$1"
Running the script I give: ./scriptName.sh directoryName
where scriptName is my script and directoryName is the argument which is the name of the directory from which the code should start.
I would like to see the output like this:
Directory: Bash/Test1Dir
File: Bash/Test1Dir/Test1Doc.txt
Directory: Bash/Test2Dir
Directory: Bash/Test2Dir/InsideTest2DirDir
File: Bash/Test2Dir/insideTest2DirDoc.txt
File: Bash/test.sh
But I have some troubles in completing this code. Could someone help me figure it out why it isn't working and what should I change?
Will be grateful.
A correct and efficient implementation might look like:
listContent() {
local dir=${1:-.} whitespacePrefix=$2 file
for file in "$dir"/*; do
[ -e "$file" ] || [ -L "$file" ] || continue
if [ -d "$file" ]; then
printf '%sDirectory %q\n' "$whitespacePrefix" "${file##*/}"
listContent "$file" "${whitespacePrefix} "
else
printf '%sFile %q\n' "$whitespacePrefix" "${file##*/}"
fi
done
}
Note:
Instead of counting spaces, we use the call stack to track the amount of whitespace, appending on each recursive call. This avoids needing to count the number of /s in each name.
We quote all parameter expansions, except in one of the limited number of contexts where string-splitting and glob expansions are implicitly avoided.
We avoid attempts to use $? for anything other than its intended purpose of tracking numeric exit status.
We use printf %q whenever uncontrolled data (such as a filename) is present, to ensure that even malicious names (containing newlines, cursor-control characters, etc) are printed unambiguously.
if you want a visual representation without the Directory and File leaders, then the following is a simple one-liner (wrapped in a shell function).
treef() (
[ -d "$1" ] && { dir="$1"; shift; } || dir='.'
find "$dir" "$#" | sed -e 's#/#|#g;s/^\.|//;s/[^|][^|]*|/ |/g;/^[. |]*$/d'
)

Editing file with vim without typing path (similar to autojump)

A few months back, I installed a utility on my mac so that instead of typing something like this:
vim /type/path/to/the/file
I could just type:
v file
9 times out of 10 it would guess the right file based on the past history, similar to the way autojump works. And instead of typing in vim I can just type the letter v.
I can't remember how I set this up though. It still works on my mac but I don't see anything in my .bash_profile that shows how I did that.
I'm trying to get this to work on my linux box.
This can be found here
https://github.com/rupa/v/blob/master/v
it should work in Linux too. It is a bash script that uses the viminfo
history file to fill in partial strings.
It can be installed on macOS with brew install v
Ah! I found the command with which. Here is the magical script. I can't determine where I got it.
#!/usr/bin/env bash
[ "$vim" ] || vim=vim
[ $viminfo ] || viminfo=~/.viminfo
usage="$(basename $0) [-a] [-l] [-[0-9]] [--debug] [--help] [regexes]"
[ $1 ] || list=1
fnd=()
for x; do case $x in
-a) deleted=1;;
-l) list=1;;
-[1-9]) edit=${x:1}; shift;;
--help) echo $usage; exit;;
--debug) vim=echo;;
--) shift; fnd+=("$#"); break;;
*) fnd+=("$x");;
esac; shift; done
set -- "${fnd[#]}"
[ -f "$1" ] && {
$vim "$1"
exit
}
while IFS=" " read line; do
[ "${line:0:1}" = ">" ] || continue
fl=${line:2}
[ -f "${fl/\~/$HOME/}" -o "$deleted" ] || continue
match=1
for x; do
[[ "$fl" =~ $x ]] || match=
done
[ "$match" ] || continue
i=$((i+1))
files[$i]="$fl"
done < "$viminfo"
if [ "$edit" ]; then
resp=${files[$edit]}
elif [ "$i" = 1 -o "$list" = "" ]; then
resp=${files[1]}
elif [ "$i" ]; then
while [ $i -gt 0 ]; do
echo -e "$i\t${files[$i]}"
i=$((i-1))
done
read -p '> ' CHOICE
resp=${files[$CHOICE]}
fi
[ "$resp" ] || exit
$vim "${resp/\~/$HOME}"

Hashing a string using a passphrase in Bash

I need a way of hashing a existing filename with a passphrase (ASCII string) but being able to revert it back afterwards using the same passphrase.
I know that ciphers can do this - they are encrypting the string... But their output lenght is based on the filename lenght, which is exactly what I do not want... mainly because it sometimes doubles the file lenght, but the outputted strings are not allways compatible with the FS. Ex. "\n" in a filename.
To be clear, I did a lot of research and even wrote some scripts, but all of the solutions are either slow, or don't work for my application at all.
The Goal of this is to get a constant length filenames that can be all 'decrypted' at once using a single passphrase. Without the need of creating additional 'metadata-like' files.
I've gotten all the way around with my initial question. There seems to be only one solution to the problem above, and that is (as James suggested) Format-preserving encryption. Altough, as far as I can tell, there are no existing commands that do this.
So I did exactly what was my very first option, and that is hashing the filename, putting the hash and the filename into a plain file (one file per directory) and encrypting that file with a passphrase.
I'll post my code here. Though it's probably not the prettiest nor the most portable code, but It does the job and is (IMO) really simple.
#!/usr/bin/env bash
man="Usage: namecrypt [ -h ] [ -e || -d ] [ -F ] [ -D ] [DIRECTORY] [PASSPHRASE]\n
-h, --help display this message
-e, --encrypt encrypt the specified directory
-d, --decrypt decrypt the specified directory
-F, --files include files
-D, --dir include directories
[DIRECTORY] relative or absolute path to a directory/symbolic link
[PASSPHRASE] optional - specify the user passphrase on command line";
options=();
for Arg in "$#"; do
if [ "$Arg" == "-h" ] || [ "$Arg" == "--help" ]; then
echo -e "$man"; exit;
elif [ "$Arg" == "-e" ] || [ "$Arg" == "--encrypt" ]; then
options[0]="E";
elif [ "$Arg" == "-d" ] || [ "$Arg" == "--decrypt" ]; then
options[0]="D";
elif [ "$Arg" == "-F" ] || [ "$Arg" == "--files" ]; then
options[1]="${options[1]}F";
elif [ "$Arg" == "-D" ] || [ "$Arg" == "--dir" ]; then
options[1]="${options[1]}D";
elif [ -d "$Arg" ]; then
options[2]="$(realpath "$Arg")";
else
options[3]="$Arg";
fi;
done;
if [ "${options[0]}" == "" ]; then echo "No Mode specified!"; exit 1; fi;
if [ "${options[1]}" == "" ]; then options[1]="F"; fi;
if [ "${options[2]}" == "" ]; then echo "No such directory!"; exit 2; fi;
if [ "${options[3]}" == "" ]; then echo "Enter a passphrase: "; read options[3]; fi;
shopt -s nullglob dotglob;
function hashTarget
{
BASE="$(basename "$1")";
DIR="$(dirname "$1")/";
if [ -a "$1" ]; then
oldName="$BASE";
newName=$(echo "$oldName" | md5sum);
echo "$oldName||$newName" >> "$DIR.names";
mv "$1" "$DIR$newName";
else echo "Skipping '$1' - No such file or directory!";
fi;
}
function dehashTarget
{
BASE="$(basename "$1")";
DIR="$(dirname "$1")/";
[ -f "$DIR.names.cpt" ] && ccdecrypt -K "${options[3]}" "$DIR.names.cpt";
if [ -f "$DIR.names" ]; then
oldName="$BASE";
newName=$(grep "$oldName" "$DIR.names" | awk -F '|' '{print $1}');
[[ ! -z "${newName// }" ]] && mv "$1" "$DIR$newName";
else
echo "Skipping '$1' - Hash table not found!";
fi;
}
function mapTarget
{
DIR="$(dirname "$1")/";
for Dir in "$1"/*/; do
mapTarget "$Dir";
done;
for Item in "$1"/*; do
if ([ -f "$Item" ] && [[ "${options[1]}" == *"F"* ]]) ||
([ -d "$Item" ] && [[ "${options[1]}" == *"D"* ]]); then
if [ "${options[0]}" == "E" ]; then
hashTarget "$Item";
else
dehashTarget "$Item";
fi;
fi;
done;
[ "${options[0]}" == "D" ] && [ -f "$DIR.names" ] && rm "$DIR.names";
[ "${options[0]}" == "E" ] && [ -f "$DIR.names" ] && ccencrypt -K "${options[3]}" "$DIR.names";
}
mapTarget "${options[2]}";
Probably the only reason why it is so long, is because I didn't bother with any OOP, and I also did a lot of checks and steps to make sure that most of the time no names get mangled and can't be restored - user error can still cause this.
This is the command used to encrypt the hash-table files: CCrypt

Checking root integrity via a script

Below is my script to check root path integrity, to ensure there is no vulnerability in PATH variable.
#! /bin/bash
if [ ""`echo $PATH | /bin/grep :: `"" != """" ]; then
echo "Empty Directory in PATH (::)"
fi
if [ ""`echo $PATH | /bin/grep :$`"" != """" ]; then echo ""Trailing : in PATH""
fi
p=`echo $PATH | /bin/sed -e 's/::/:/' -e 's/:$//' -e 's/:/ /g'`
set -- $p
while [ ""$1"" != """" ]; do
if [ ""$1"" = ""."" ]; then
echo ""PATH contains ."" shift
continue
fi
if [ -d $1 ]; then
dirperm=`/bin/ls -ldH $1 | /bin/cut -f1 -d"" ""`
if [ `echo $dirperm | /bin/cut -c6 ` != ""-"" ]; then
echo ""Group Write permission set on directory $1""
fi
if [ `echo $dirperm | /bin/cut -c9 ` != ""-"" ]; then
echo ""Other Write permission set on directory $1""
fi
dirown=`ls -ldH $1 | awk '{print $3}'`
if [ ""$dirown"" != ""root"" ] ; then
echo $1 is not owned by root
fi
else
echo $1 is not a directory
fi
shift
done
The script works fine for me, and shows all vulnerable paths defined in the PATH variable. I want to also automate the process of correctly setting the PATH variable based on the above result. Any quick method to do that.
For example, on my Linux box, the script gives output as:
/usr/bin/X11 is not a directory
/root/bin is not a directory
whereas my PATH variable have these defined,and so I want to have a delete mechanism, to remove them from PATH variable of root. lot of lengthy ideas coming in mind. But searching for a quick and "not so complex" method please.
No offense but your code is completely broken. Your using quotes in a… creative way, yet in a completely wrong way. Your code is unfortunately subject to pathname expansions and word splitting. And it's really a shame to have an insecure code to “secure” your PATH.
One strategy is to (safely!) split your PATH variable into an array, and scan each entry. Splitting is done like so:
IFS=: read -r -d '' -a path_ary < <(printf '%s:\0' "$PATH")
See my mock which and How to split a string on a delimiter answers.
With this command you'll have a nice array path_ary that contains each fields of PATH.
You can then check whether there's an empty field, or a . field or a relative path in there:
for ((i=0;i<${#path_ary[#]};++i)); do
if [[ ${path_ary[i]} = ?(.) ]]; then
printf 'Warning: the entry %d contains the current dir\n' "$i"
elif [[ ${path_ary[i]} != /* ]]; then
printf 'Warning: the entry %s is not an absolute path\n' "$i"
fi
done
You can add more elif's, e.g., to check whether the entry is not a valid directory:
elif [[ ! -d ${path_ary[i]} ]]; then
printf 'Warning: the entry %s is not a directory\n' "$i"
Now, to check for the permission and ownership, unfortunately, there are no pure Bash ways nor portable ways of proceeding. But parsing ls is very likely not a good idea. stat can work, but is known to have different behaviors on different platforms. So you'll have to experiment with what works for you. Here's an example that works with GNU stat on Linux:
read perms owner_id < <(/usr/bin/stat -Lc '%a %u' -- "${path_ary[i]}")
You'll want to check that owner_id is 0 (note that it's okay to have a dir path that is not owned by root; for example, I have /home/gniourf/bin and that's fine!). perms is in octal and you can easily check for g+w or o+w with bit tests:
elif [[ $owner_id != 0 ]]; then
printf 'Warning: the entry %s is not owned by root\n' "$i"
elif ((0022&8#$perms)); then
printf 'Warning: the entry %s has group or other write permission\n' "$i"
Note the use of 8#$perms to force Bash to understand perms as an octal number.
Now, to remove them, you can unset path_ary[i] when one of these tests is triggered, and then put all the remaining back in PATH:
else
# In the else statement, the corresponding entry is good
unset_it=false
fi
if $unset_it; then
printf 'Unsetting entry %s: %s\n' "$i" "${path_ary[i]}"
unset path_ary[i]
fi
of course, you'll have unset_it=true as the first instruction of the loop.
And to put everything back into PATH:
IFS=: eval 'PATH="${path_ary[*]}"'
I know that some will cry out loud that eval is evil, but this is a canonical (and safe!) way to join array elements in Bash (observe the single quotes).
Finally, the corresponding function could look like:
clean_path() {
local path_ary perms owner_id unset_it
IFS=: read -r -d '' -a path_ary < <(printf '%s:\0' "$PATH")
for ((i=0;i<${#path_ary[#]};++i)); do
unset_it=true
read perms owner_id < <(/usr/bin/stat -Lc '%a %u' -- "${path_ary[i]}" 2>/dev/null)
if [[ ${path_ary[i]} = ?(.) ]]; then
printf 'Warning: the entry %d contains the current dir\n' "$i"
elif [[ ${path_ary[i]} != /* ]]; then
printf 'Warning: the entry %s is not an absolute path\n' "$i"
elif [[ ! -d ${path_ary[i]} ]]; then
printf 'Warning: the entry %s is not a directory\n' "$i"
elif [[ $owner_id != 0 ]]; then
printf 'Warning: the entry %s is not owned by root\n' "$i"
elif ((0022 & 8#$perms)); then
printf 'Warning: the entry %s has group or other write permission\n' "$i"
else
# In the else statement, the corresponding entry is good
unset_it=false
fi
if $unset_it; then
printf 'Unsetting entry %s: %s\n' "$i" "${path_ary[i]}"
unset path_ary[i]
fi
done
IFS=: eval 'PATH="${path_ary[*]}"'
}
This design, with if/elif/.../else/fi is good for this simple task but can get awkward to use for more involved tests. For example, observe that we had to call stat early before the tests so that the information is available later in the tests, before we even checked that we're dealing with a directory.
The design may be changed by using a kind of spaghetti awfulness as follows:
for ((oneblock=1;oneblock--;)); do
# This block is only executed once
# You can exit this block with break at any moment
done
It's usually much better to use a function instead of this, and return from the function. But because in the following I'm also going to check for multiple entries, I'll need to have a lookup table (associative array), and it's weird to have an independent function that uses an associative array that's defined somewhere else…
clean_path() {
local path_ary perms owner_id unset_it oneblock
local -A lookup
IFS=: read -r -d '' -a path_ary < <(printf '%s:\0' "$PATH")
for ((i=0;i<${#path_ary[#]};++i)); do
unset_it=true
for ((oneblock=1;oneblock--;)); do
if [[ ${path_ary[i]} = ?(.) ]]; then
printf 'Warning: the entry %d contains the current dir\n' "$i"
break
elif [[ ${path_ary[i]} != /* ]]; then
printf 'Warning: the entry %s is not an absolute path\n' "$i"
break
elif [[ ! -d ${path_ary[i]} ]]; then
printf 'Warning: the entry %s is not a directory\n' "$i"
break
elif [[ ${lookup[${path_ary[i]}]} ]]; then
printf 'Warning: the entry %s appears multiple times\n' "$i"
break
fi
# Here I'm sure I'm dealing with a directory
read perms owner_id < <(/usr/bin/stat -Lc '%a %u' -- "${path_ary[i]}")
if [[ $owner_id != 0 ]]; then
printf 'Warning: the entry %s is not owned by root\n' "$i"
break
elif ((0022 & 8#$perms)); then
printf 'Warning: the entry %s has group or other write permission\n' "$i"
break
fi
# All tests passed, will keep it
lookup[${path_ary[i]}]=1
unset_it=false
done
if $unset_it; then
printf 'Unsetting entry %s: %s\n' "$i" "${path_ary[i]}"
unset path_ary[i]
fi
done
IFS=: eval 'PATH="${path_ary[*]}"'
}
All this is really safe regarding spaces and glob characters and newlines inside PATH; the only thing I don't really like is the use of the external (and non-portable) stat command.
I'd recommend you get a good book on Bash shell scripting. It looks like you learned Bash from looking at 30 year old system shell scripts and by hacking away. This isn't a terrible thing. In fact, it shows initiative and great logic skills. Unfortunately, it leads you down to some really bad code.
If statements
In the original Bourne shell the [ was a command. In fact, /bin/[ was a hard link to /bin/test. The test command was a way to test certain aspects of a file. For example test -e $file would return a 0 if the $file was executable and a 1 if it wasn't.
The if merely took the command after it, and would run the then clause if that command returned an exit code of zero, or the else clause (if it exists) if the exit code wasn't zero.
These two are the same:
if test -e $file
then
echo "$file is executable"
fi
if [ -e $file ]
then
echo "$file is executable"
fi
The important idea is that [ is merely a system command. You don't need these with the if:
if grep -q "foo" $file
then
echo "Found 'foo' in $file"
fi
Note that I am simply running grep and if grep is successful, I'm echoing my statement. No [ ... ] are necessary.
A shortcut to the if is to use the list operators && and ||. For example:
grep -q "foo" $file && echo "I found 'foo' in $file"
is the same as the above if statement.
Never parse ls
You should never parse the ls command. You should use stat instead. stat gets you all the information in the command, but in an easily parseable form.
[ ... ] vs. [[ ... ]]
As I mentioned earlier, in the original Bourne shell, [ was a system command. In Kornshell, it was an internal command, and Bash carried it over too.
The problem with [ ... ] is that the shell would first interpolate the command before the test was performed. Thus, it was vulnerable to all sorts of shell issues. The Kornshell introduced [[ ... ]] as an alternative to the [ ... ] and Bash uses it too.
The [[ ... ]] allows Kornshell and Bash to evaluate the arguments before the shell interpolates the command. For example:
foo="this is a test"
bar="test this is"
[ $foo = $bar ] && echo "'$foo' and '$bar' are equal."
[[ $foo = $bar ]] && echo "'$foo' and '$bar' are equal."
In the [ ... ] test, the shell interpolates first which means that it becomes [ this is a test = test this is ] and that's not valid. In [[ ... ]] the arguments are evaluated first, thus the shell understands it's a test between $foo and $bar. Then, the values of $foo and $bar are interpolated. That works.
For loops and $IFS
There's a shell variable called $IFS that sets how read and for loops parse their arguments. Normally, it's set to space/tab/NL, but you can modify this. Since each PATH argument is separated by :, you can set IFS=:", and use a for loop to parse your $PATH.
The <<< Redirection
The <<< allows you to take a shell variable and pass it as STDIN to the command. These both more or less do the same thing:
statement="This contains the word 'foo'"
echo "$statement" | sed 's/foo/bar/'
statement="This contains the word 'foo'"
sed 's/foo/bar/'<<<$statement
Mathematics in the Shell
Using ((...)) allows you to use math and one of the math function is masking. I use masks to determine whether certain bits are set in the permission.
For example, if my directory permission is 0755 and I and it against 0022, I can see if user read and write permissions are set. Note the leading zeros. That's important, so that these are interpreted as octal values.
Here's your program rewritten using the above:
#! /bin/bash
grep -q "::" <<<"$PATH" && echo "Empty directory in PATH ('::')."
grep -q ":$" <<<$PATH && "PATH has trailing ':'"
#
# Fix Path Issues
#
path=$(sed -e 's/::/:/g' -e 's/:$//'<<<$PATH);
OLDIFS="$IFS"
IFS=":"
for directory in $PATH
do
[[ $directory == "." ]] && echo "Path contains '.'."
[[ ! -d "$directory" ]] && echo "'$directory' isn't a directory in path."
mode=$(stat -L -f %04Lp "$directory") # Differs from system to system
[[ $(stat -L -f %u "$directory") -eq 0 ]] && echo "Directory '$directory' owned by root"
((mode & 0022)) && echo "Group or Other write permission is set on '$directory'."
done
I'm not 100% sure what you want to do or mean about PATH Vulnerabilities. I don't know why you care whether a directory is owned by root, and if an entry in the $PATH is not a directory, it won't affect the $PATH. However, one thing I would test for is to make sure all directories in your $PATH are absolute paths.
[[ $directory != /* ]] && echo "Directory '$directory' is a relative path"
The following could do the whole work and also removes duplicate entries
export PATH="$(perl -e 'print join(q{:}, grep{ -d && !((stat(_))[2]&022) && !$seen{$_}++ } split/:/, $ENV{PATH})')"
I like #kobame's answer but if you don't like the perl-dependency you can do something similar to:
$ cat path.sh
#!/bin/bash
PATH="/root/bin:/tmp/groupwrite:/tmp/otherwrite:/usr/bin:/usr/sbin"
echo "${PATH}"
OIFS=$IFS
IFS=:
for path in ${PATH}; do
[ -d "${path}" ] || continue
paths=( "${paths[#]}" "${path}" )
done
while read -r stat path; do
[ "${stat:5:1}${stat:8:1}" = '--' ] || continue
newpath="${newpath}:${path}"
done < <(stat -c "%A:%n" "${paths[#]}" 2>/dev/null)
IFS=${OIFS}
PATH=${newpath#:}
echo "${PATH}"
$ ./path.sh
/root/bin:/tmp/groupwrite:/tmp/otherwrite:/usr/bin:/usr/sbin
/usr/bin:/usr/sbin
Note that this is not portable due to stat not being portable but it will work on Linux (and Cygwin). For this to work on BSD systems you will have to adapt the format string, other Unices don't ship with stat at all OOTB (Solaris, for example).
It doesn't remove duplicates or directories not owned by root either but that can easily be added. The latter only requires the loop to be adapted slightly so that stat also returns the owner's username:
while read -r stat owner path; do
[ "${owner}${stat:5:1}${stat:8:1}" = 'root--' ] || continue
newpath="${newpath}:${path}"
done < <(stat -c "%A:%U:%n" "${paths[#]}" 2>/dev/null)

Resources