I need access to the /home of a systemuser ‘iobroker’
My default user is member of group ‘iobroker’.
But I can’t access the directory. Has it to do with ACLs?
Not sure if your terminal prompt as seen above is standard or otherwise edited in your console app, but might it be the case that you are trying to see iobroker’s directory as user thomas instead of as iobroker? If so, presumably that’s your objective?
Related: can you confirm for yourself that thomas is currently a member of iobroker group? (thomas may not be your typical default user)
I think this is only part of the solution. They can enter the directory, but they cannot list the files within it
I’d suggest sudo chmod g+x /home/iobroker --recursive
No, that’s definitely not right because you you would be adding the execute permission to all files inside.
The permissions for this directory have obviously been “messed with”, since the directory was missing the executable bit in the first place. So far there is not enough information in the thread to be able to tell what configuration error has been made.
For example, how was this directory created? With useradd -m, or mkdir, or…?
We can see the permissions for this directory were modified at some point, but how specifically were they modified? What commands were run? Did directory access work normally before that?
The user is being created by an installation script. The respective part looks like this:
create_user_linux() {
username="$1"
id "$username" &> /dev/null;
if [ $? -ne 0 ]; then
# User does not exist
$SUDOX useradd -m -s /usr/sbin/nologin "$username"
echo "User $username created"
fi
# Add the current non-root user to the iobroker group so he can access the iobroker dir
if [ "$username" != "$USER" ] && [ "$IS_ROOT" = false ]; then
sudo usermod -a -G $username $USER
fi
SUDOERS_CONTENT="$username ALL=(ALL) ALL\n"
# Add the user to all groups we need and give him passwordless sudo privileges
# Define which commands iobroker may execute as sudo without password
declare -a iob_commands=(
"shutdown" "halt" "poweroff" "reboot"
"systemctl start" "systemctl stop"
"mount" "umount" "systemd-run"
"apt-get" "apt" "dpkg" "make"
"ping" "fping"
"arp-scan"
"setcap"
"vcgencmd"
"cat"
"df"
"mysqldump"
"ldconfig"
)
add2sudoers "$username ALL=(ALL) " "${iob_commands[@]}"
# Additionally, define which iobroker-related commands may be executed by every user
declare -a all_user_commands=(
"systemctl start iobroker"
"systemctl stop iobroker"
"systemctl restart iobroker"
)
add2sudoers "ALL ALL=" "${all_user_commands[@]}"
# Furthermore, allow all users to execute node iobroker.js as iobroker
if [ "$IOB_USER" != "$USER" ]; then
add2sudoers "ALL ALL=($IOB_USER) " "node $CONTROLLER_DIR/iobroker.js *"
fi
SUDOERS_FILE="/etc/sudoers.d/iobroker"
$SUDOX rm -f $SUDOERS_FILE
echo -e "$SUDOERS_CONTENT" > ~/temp_sudo_file
$SUDOX visudo -c -q -f ~/temp_sudo_file && \
$SUDOX chown root:$ROOT_GROUP ~/temp_sudo_file &&
$SUDOX chmod 440 ~/temp_sudo_file &&
$SUDOX mv ~/temp_sudo_file $SUDOERS_FILE &&
echo "Created $SUDOERS_FILE"
# Add the user to all groups if they exist
declare -a groups=(
audio
bluetooth
dialout
gpio
i2c
plugdev
redis
tty
video
)
for grp in "${groups[@]}"; do
getent group $grp &> /dev/null && $SUDOX usermod -a -G $grp $username
done
}
[thomas@daleth ~]$ id thomas
id iobroker
uid=1000(thomas) gid=1000(thomas) groups=1000(thomas),998(wheel),984(users),1001(iobroker)
uid=1001(iobroker) gid=1001(iobroker) groups=1001(iobroker),998(wheel),996(audio),5(tty),985(video)
[thomas@daleth ~]$
I just found that there is no sodoers entry for iobroker. Will dig around there…
I haven’t configured SELinux nor AppArmor. The system is Endeavour OS on ARM / Raspberry 4.
Don’t know if either one comes preconfigured.
Is /home/iobroker mounted over NFS, or any other network filesystem that might have different permission settings?
No, all Filesystems are local ones.
/dev/mmcblk0p1 on /boot type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro)
/dev/mmcblk0p2 on / type ext4 (rw,relatime)
The installer is very Debian-centric. It runs succesfully over there. I just wanted to port it over to Arch / EOS.
Is it possible you have an issue with the SD card? They do tend to have limited writes. If the filesystem is not intact it could conceivably cause permission-related issues.
sudo smartctl -a /dev/mmcblk0
It may also be worth running fsck when the disk is not mounted (for example, from a live environment), if you have not done that yet.
