Check permissions on startup

[axxelG]

A manual Java installation lead to some minor troubleshooting. For that I startet openHAP as root. Some files and directories are created on fist start so these got owned by root and the normal start of the service with user openhab failed. Google showed some openHAB users struggeling with permissions and I guessed that starting openHAB with a wrong user could be a common pitfall if a package installation for Java AND openHAB is not possible or not working.

I suggest a simple check in start_debug.sh.

• Is this failure worth a check?
• Is the start skript the right place for this check?
• Is stderr the right target or should the error go somewhere else?
• Should the skript exit on failure? Exit code?
• Should this be ckecked in start.sh, too?

[kaikreuzer]

Thanks for your suggestions. Unfortunately, start.sh is definitely not he right place for it. You should note that openHAB is using Apache Karaf for all the container management. Karaf already does a lot of tests, also whether you started as root or not.

So the issue here might be that openHAB is creating directories in the setenv script, which is executed BEFORE those tests are done. So these scripts would imho be the right place to address the issue.

[axxelG]

Nevermind, I see only one advantage in putting it to the start script: You get instant feedback. If I remember right /var/log/openhab had wrong permissions as well so only /var/log/daemon.log delivered usefull informations. I won't be able to help here anymore but maybe someone will come up with a better solution. And after all it is not a big thing, just saves some pain if the installation is allready not working "out of the box".

[kaikreuzer]

It is a valid concern and I think it would make a lot of sense to only start creating folders AFTER the root check has been performed.

@BClark09 In case you want to go for the setenv update, maybe you could keep this issue in mind and check how it could be addressed?

[BClark09]

I'll see what I can do! :)

As a sidenote, users of the linuxpkg can use openhab-cli info right now to test:

user@server:~ $ openhab-cli info
Version:        2.2.0-SNAPSHOT (#1077)
User:           openhab (Active Process 2193)
User Groups:    openhab tty dialout

Directories:    Folder Name      | Path                           | User:Group
                -----------      | ----                           | ----------
                OPENHAB_HOME     | /usr/share/openhab2            | openhab:openhab
                OPENHAB_RUNTIME  | /usr/share/openhab2/runtime    | openhab:openhab
                OPENHAB_USERDATA | /var/lib/openhab2              | openhab:openhab
                OPENHAB_CONF     | /etc/openhab2                  | openhab:openhab
                OPENHAB_LOGDIR   | /var/log/openhab2              | openhab:openhab
                OPENHAB_BACKUPS  | /var/lib/openhab2/backups      | root:root

Dashboard URLs: http://192.168.0.10:8080
                https://192.168.0.10:8443

[txmiker]

Would it make sense for the start.sh to check if any files in the OH directory don't belong to the calling user or group ID(s)? (except if starting as root)? If any files aren't owned by the starting user/group, display a warning for possible issues, details, etc. and option to continue or not?

If it does, I can propose a PR for the start.sh with some "pre-flight" checks.

[axxelG]

Checking against the user who started the process is a good idea. Checking against all files or folders IMHO not because users may put random stuff into random folders and that should not prevent openHAB from starting. But nevertheless like @kaikreuzer mentioned the startup script is not the prefered place for this check.

[txmiker]

@axxelG I stand corrected on the startup sh. I initially read it as at 1st NOT thinking startup.sh would be a good place but later down that it might be the only place.. :-(

I created a "pre-flight" script to verify that the initiating user has permissions, sample output included below. If you are root/0, doesn't bother saying "running as root". (may be a good place to put a public service announcement to not run stuff as root :-) )

an array of file/dir patterns to include/exclude would be pretty easy.

~/openhab2$` . ./chk_perm.sh
PreFlight:  Validating files permissions for current userID: 1000, groupID: 1000
##########  Warning!
###
###   442 files are not owned by the current starting user or group ID.
###   You may experience problems due to file permissions.
###   
###   Please see https://community.openhab.org/t/nix-file-perms  <--  Would need to create an article
###   for further information.
###
      Continuing in xx seconds.... or CTRL-C to abort.

If startup.sh isn't ideal, possibly a standalone script? Other "preFlight" checks could be added

If this was inline with the original intent of this post, let me know, or if this would be helpful.

[kaikreuzer]

@txmiker As mentioned above, Karaf already does a couple of checks before the startup - wouldn't it make sense to rather suggest your additions to the Karaf project itself as it could be beneficial for all their users?

[txmiker]

Good points; agreed. The karaf startup doesn't appear to do any file permissions checks currently, only if you allow to run as root or not. Potentially a specific set of checks may be beneficial there.

I could see a scenario where the karaf runtime env permissions are fine, but OH files created/sftp'd by users may not be?

If this may be better addressed in Karaf, is there still an open issue here? Otherwise, it appears that permissions issues and resolution are addressed in the docs at http://docs.openhab.org/installation/linux.html (vs. a code solution)