Permissions of nonce file

[cjustin88]

Have you checked borgbackup docs, FAQ, and open Github issues?

Yes

Is this a BUG / ISSUE report or a QUESTION?

Question

System information. For client/server mode post info for both machines.

Your borg version (borg -V).

1.1.7

Operating system (distribution) and version.

Fedora 29

Hardware / network configuration, and filesystems used.

ext4

How much data is handled by borg?

5 GB

Full borg commandline that lead to the problem (leave away excludes and passwords)

Command generated by borgmatic: borg create /path/borgrepo::{hostname}-{now:%Y-%m-%dT%H:%M:%S.%f} /etc /var /usr /root /opt /bin /boot --exclude-from /tmp/tmpwcr9z7ud --exclude-caches --exclude-if-present .nobackup --compression lzma --one-file-system --umask 22 --list --filter AME- --stats --debug --show-rc

Describe the problem you're observing.

nonce file in repository directory is only readable by root:

-rw-r--r-- 1 root root      209 Feb 14 14:02 config
drwxr--r-- 3 root root     4096 Feb 14 14:03 data
-rw-r--r-- 1 root root      107 Feb 16 19:49 hints.42
-rw-r--r-- 1 root root 17825978 Feb 16 19:49 index.42
-rw-r--r-- 1 root root      190 Feb 16 19:49 integrity.42
-rw------- 1 root root       16 Feb 16 19:49 nonce
-rw-r--r-- 1 root root       73 Feb 14 14:02 README

Is this the intended behaviour? Is this file necessary for restore and backup? e.g. if I sync the repository with a non-root account to a remote target, the nonce file will not be synced since it cannot be read by any other user (only root). Does that make the backup unusable?

Can you reproduce the problem? If so, describe how. If not, describe troubleshooting steps you took before opening the issue.

Yes. If I chmod the nonce to be readable by others, it is set back to readable only by root after running borg. Is this the intended behaviour?

Include any warning/errors/backtraces from the system logs

None.

[ThomasWaldmann]

I checked the current 1.1-maint code and didn't find any chmod call for that.

So I guess it is related to the effective umask.

BTW, there is no need to run the repo access as root. Try a borg@localhost:... repo url.

[cjustin88]

BTW, there is no need to run the repo access as root. Try a borg@localhost:... repo url.

I am running borg as root because this is a system backup. The "URL" in my above example was auto-generated by borgmatic. Is that OK?

So I guess it is related to the effective umask.

I am using umask 22. Shouldn't that make the nonce file have permissions of 644 (if borg decides to use the default permissions for the nonce file)?

[ThomasWaldmann]

btw, just cosmetics, but rather use umask 0022 (leading 0 to indicate octal, next 3 digits for the mask).

[ThomasWaldmann]

can you post the output of this?

# use same path as in your problematic case, just a new directory right besides the other one
borg init -e repokey --umask 0022 /path/borgrepo-test
borg create --umask 0022 /path/borgrepo-test::test /bin
ls -l /path/borgrepo-test

[cjustin88]

Interesting...the permissions are set correctly:

[root@epsilonlinux]/run/media/justin/epsilon_backup# ll Dropbox/borgtest
total 68
-rw-r--r-- 1 root root   700 Feb 18 19:15 config
drwxr-xr-x 3 root root  4096 Feb 18 19:15 data
-rw-r--r-- 1 root root    52 Feb 18 19:15 hints.5
-rw-r--r-- 1 root root 41258 Feb 18 19:15 index.5
-rw-r--r-- 1 root root   190 Feb 18 19:15 integrity.5
-rw-r--r-- 1 root root    16 Feb 18 19:15 nonce
-rw-r--r-- 1 root root    73 Feb 18 19:15 README

[ThomasWaldmann]

OK, so I suspect that you just messed up permissions somehow and there is no issue in borg. Maybe by running borg with different or no --umask sometimes.

chmod -R is your friend. :)

[cjustin88]

I figured out why the permissions got screwed up. I initialized the repository as justin, then made backups to it as local root user (directly, not through SSH). I switched to making backups as root user, but via SSH (i.e. justin@localhost:/path/borg/repo). This fixes the permissions issue.