Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Mailing lists / fpc-pascal / 2012-09

Issue with deploying linux application in /opt directory

11 messages · 5 people · –

Reply by email Subscribe to this list Your subscription

Read-only archive. Use j and k to move between messages.

Krzysztof

Hi,

I have script which install my application in /opt/myapp directory. This script check if user is root so it can set permissions to read and access as executable. Everything works fine. After installation I can run this application, but It doesn't has access to the internet. I must manually set owner to whole application directory: "sudo chown MY_NAME -R /opt/myapp". Now, I have access to internet. Does anyone know how to properly prepare installation script which set permissions in /opt directory? User should simply extract zipped application, run setup skrypt and run app

Regards

Reply by email

Michael Van Canneyt
to Krzysztof
Krzysztof wrote 11 lines
Hi, I have script which install my application in /opt/myapp directory. This script check if user is root so it can set permissions to read and access as executable. Everything works fine. After installation I can run this application, but It doesn't has access to the internet. I must manually set owner to whole application directory: "sudo chown MY_NAME -R /opt/myapp". Now, I have access to internet. Does anyone know how to properly prepare installation script which set permissions in /opt directory? User should simply extract zipped application, run setup skrypt and run app

That is the wrong approach to solving the problem.

You should find out why your app needs to write to this location, and remove that need.

strace -o /tmp/log /opt/myapp/myapp.bin

will write all kernel calls to /tmp/log. There you can look for a call open("/opt/myapp/something", O_CREATE||O_WRITE) = -1 to see what file it attempts to write.

Michael.

Reply by email

Krzysztof
to Michael Van Canneyt

Hmm problem is that I'm trying deploy libQt4Pas with my application (I have run.sh script which do "export
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/myapp/lib" before running application) and I see that this library trying do something in /opt folder:
open("/opt/myapp/lib/tls/x86_64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/opt/myapp/lib/tls/x86_64", 0x7fff625d38f0) = -1 ENOENT (No such file or directory)
open("/opt/myapp/lib/tls/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/opt/myapp/lib/tls", 0x7fff625d38f0) = -1 ENOENT (No such file or directory)
open("/opt/myapp/lib/x86_64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/opt/myapp/lib/x86_64", 0x7fff625d38f0) = -1 ENOENT (No such file or directory)
open("/opt/myapp/lib/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat("/opt/myapp/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0

That's why I didn't have this problem on my app for GTK (I'm testing it now for KDE)

Reply by email

Bernd
to Krzysztof

2012/9/3 Krzysztof :

Show quoted text 20 lines
Hmm problem is that I'm trying deploy libQt4Pas with my application (I have run.sh script which do "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/myapp/lib" before running application) and I see that this library trying do something in /opt folder: open("/opt/myapp/lib/tls/x86_64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) stat("/opt/myapp/lib/tls/x86_64", 0x7fff625d38f0) = -1 ENOENT (No such file or directory) open("/opt/myapp/lib/tls/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) stat("/opt/myapp/lib/tls", 0x7fff625d38f0) = -1 ENOENT (No such file or directory) open("/opt/myapp/lib/x86_64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) stat("/opt/myapp/lib/x86_64", 0x7fff625d38f0) = -1 ENOENT (No such file or directory) open("/opt/myapp/lib/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) stat("/opt/myapp/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0

This looks normal. Its searching for libpthread (probably because cthreads is used) in this folder because you added the folder to the library path. This is normal and it does only try to read, not write. It will also search this lib in /usr/lib and will finally find it there, so this does not look the cause of your problem. It must be something else.

You said it cannot access the network. This has nothing to do with folder permissions. Try to catch the possible errors in your code and put some writeln() into the code to see what exactly is going on when it is trying to make a network connection, maybe it does not even reach that part of your code because something else is silently failing and you your code is just ignoring the error. Try to catch all possible errors and write some diagnostic information to the console.

Or maybe you are already trying to write a debug log file into the application directory (not allowed!) and this is failing because of permissions and due to some unlucky try/except an important part of your code will never execute and makes it behave as if the error where somewhere else? (Just a wild guess but I have made errors like this before too)

try
  WriteToLog('will now connect');  // <--- this will raise exception
already here
  ConnectToTheServer();
  DoEvenMoreStuff();
except
  // nothing
end;

This would silently fail to connect but its not because of network problems, its because something happened that you simply did not expect to ever happen when writing the code.

Reply by email

Reinier Olislagers
to Krzysztof: I have script which install my application in /opt/myapp directory. This script check if…
Krzysztof wrote 11 lines
Hi, I have script which install my application in /opt/myapp directory. This script check if user is root so it can set permissions to read and access as executable. Everything works fine. After installation I can run this application, but It doesn't has access to the internet. I must manually set owner to whole application directory: "sudo chown MY_NAME -R /opt/myapp". Now, I have access to internet. Does anyone know how to properly prepare installation script which set permissions in /opt directory? User should simply extract zipped application, run setup skrypt and run app

Perhaps you're using some protection/privilege management system (AppArmor, SELinux, something else) that restricts internet access to the application running under root... but mysteriously doesn't restrict it when it is running under your account???
Is your account member of some group that has "all network access allowed" permissions, while root isn't?

Just a long shot from somebody who occassionally touches a Linux VM, Reinier

Reply by email

Bernd
to Reinier Olislagers

2012/9/4 Reinier Olislagers :

Perhaps you're using some protection/privilege management system (AppArmor, SELinux, something else) that restricts internet access to the application running under root...

The owner of the file or the folder does not affect under which UID it will run. All other programs in the system and the folders where they are installed are usually owned by root (to prevent manipulation by users) but this does NOT affect in any way under which UID they will run when they are started. They will always run with the UID of the user who started them (unless you set the suid bit which is considered evil and should not be neccessary in most normal situations).

Reply by email

Mark Morgan Lloyd
to Reinier Olislagers: Perhaps you're using some protection/privilege management system (AppArmor, SELinux,…
Reinier Olislagers wrote 19 lines
On 3-9-2012 20:17, Krzysztof wrote: > Hi, > > I have script which install my application in /opt/myapp directory. > This script check if user is root so it can set permissions to read > and access as executable. Everything works fine. After installation I > can run this application, but It doesn't has access to the internet. I > must manually set owner to whole application directory: "sudo chown > MY_NAME -R /opt/myapp". Now, I have access to internet. Does anyone > know how to properly prepare installation script which set permissions > in /opt directory? User should simply extract zipped application, run > setup skrypt and run app Perhaps you're using some protection/privilege management system (AppArmor, SELinux, something else) that restricts internet access to the application running under root... but mysteriously doesn't restrict it when it is running under your account??? Is your account member of some group that has "all network access allowed" permissions, while root isn't?

Broadly agreed. Messing around with ownership of anything other than the installed file (or installing extra libraries etc. that might clash with what's already on the system) should be done only as a last resort, and will probably need tailoring to the distro and version in question.

"Doesn't has access" /how/ exactly? What are you trying to do: connect to a remote HTTP port? Create a local HTTP port? Ping a remote address? Fabricate a non-standard packet to see how a remote port responds?

What files were changed by the chown -R operation? In other words, compare before and after.

Mark Morgan Lloyd markMLl .AT. telemetry.co .DOT. uk [Opinions above are the author's, not those of his employers or colleagues]

Reply by email

Reinier Olislagers
to Bernd: 2012/9/4 Reinier Olislagers : The owner of the file or the folder does not affect under…
Bernd wrote
The owner of the file or the folder does not affect under which UID it will run.

Agreed.

They will always run with the UID of the user who started them (unless you set the suid bit which is considered evil and should not be neccessary in most normal situations).

Agreed.

I don't know if SELinux, AppArmor etc take file ownership into account - perhaps they don't (did throw in a disclaimer in my email :) ) Also, it isn't clear to me whether the OP runs his application as root or as his user before and after his chown -R operation...

Reply by email

Mark Morgan Lloyd
to Bernd: 2012/9/4 Reinier Olislagers : The owner of the file or the folder does not affect under…
Bernd wrote 13 lines
2012/9/4 Reinier Olislagers : > Perhaps you're using some protection/privilege management system > (AppArmor, SELinux, something else) that restricts internet access to > the application running under root... The owner of the file or the folder does not affect under which UID it will run. All other programs in the system and the folders where they are installed are usually owned by root (to prevent manipulation by users) but this does NOT affect in any way under which UID they will run when they are started. They will always run with the UID of the user who started them (unless you set the suid bit which is considered evil and should not be neccessary in most normal situations).

Setuid root does not work with GTK. Appropriate use of capabilities does.

Mark Morgan Lloyd markMLl .AT. telemetry.co .DOT. uk [Opinions above are the author's, not those of his employers or colleagues]

Reply by email

Bernd
to Mark Morgan Lloyd: Broadly agreed. Messing around with ownership of anything other than the installed file…

2012/9/4 Mark Morgan Lloyd :

What files were changed by the chown -R operation? In other words, compare before and after.

One more thing comes to mind: It is necessary to set the x bit for folders. If you create the directory tree and then recursively chown and chmod all files and folders then it must NOT remove the x bits for all folders because for folders the this bit means "directory is browseable".

the installer should do:

* chown root:root the folder and everything inside it
* chmod 0755 the folder and all sub-folders
* chmod 0644 all files inside these folders
* chmod 0755 your executable file

And then the application itself must be written in such a way that it can run without problems under these circumstances which should be easily possible (if its not an admin tool itself like for example mount that needs special privileges anyways to do anything useful).

Reply by email

Krzysztof
to Bernd

Ouch, my fault :/ . I have created new build mode for QT from GTK build mode (stripped, without logs etc), but don't know why it copied also my debug defines from debug build mode. So, http threads tried to log response in opt folder. This fail so thread fail and this meant for me that something is wrong with connection. Sorry for the hassle, I should come to this by my self.

Reply by email