9

I'm trying to run a game called "Dofus", in Manjaro Linux. I've installed it with packer, that put it under /opt/ankama folder. This folder ownership (and for every file inside it) is root user, and games group. As instructed by the installing package, I've added myself (user familia) in the games group (by not doing so, "I would have to input my password every time I tried to run the updater").

However, when running the game, it crashes after inputting my password (which shouldn't be required). Checking the logs, I've got some errors like those:

[29/08 20:44:07.114]{T001}INFO    c/net/NetworkAccessManager.cpp L87  : Starting request GET http://dl.ak.ankama.com/updates/uc1/projects/dofus2/updates/check.9554275D
[29/08 20:44:07.291]{T001}INFO    c/net/NetworkAccessManager.cpp L313 : Request GET http://dl.ak.ankama.com/updates/uc1/projects/dofus2/updates/check.9554275D Finished (status : 200)
[29/08 20:44:07.292]{T001}ERROR   n/src/update/UpdateProcess.cpp L852 : Can not cache script data

So, I suspect Permission Denied errors. An error message a moment after startingenter image description here

That translates to "An error has happened while writing to the disk - verify if you have the sufficient rights and enough disk space".

Then, after some research, I came across "auditd" that can log file accesses in a folder. After setting it up, and seeing which file accesses were unsuccessful, this is the result.

All of those errors actually refer to a unique file, /opt/ankama/transition/transition, with a syscall to (open). This file's permissions are rwxrwxr-x (775). So, I've rwx permissions to it, yet it gives me an error exit -13, which is a EACESS error (Permission Denied).

I've already tried to reboot the computer, to log in and log out. None of them worked.

If I set the folder permissions to familia:games, it runs with no trouble, I don't even need to input my password. However, it doesn't seem right this way. Any ideas of why I get Permission Denied errors even though I have read/write/execute permissions?

Mark has said that I could need +x permissions in all directories of the path prefix. The path itself is /opt/ankama/transition/transition. The permissions for the path prefixes are:

/opt - drwxr-xr-x(755), ownership root:root

/opt/ankama - drwxr-xr-x(755), ownership root:games

/opt/ankama/transition - drwxrwxr-x(775), ownership root:games

However, one thing that I've noticed is that all subfolders of /opt/ankama are 775, even though the folder itself is 755. I don't think this means anything, and changing the permissions to 775 doesn't work.

Also, Giel suggested that I could have AppArmor running on my system. However, running # cat /sys/module/apparmor/parameters/enabled gives me N.

Improve this question
9
  • 1
    EACCESS can also result when "search permission is denied for one of the directories in the path prefix of pathname", so check that all the directories have their 'x' permission bits on.
    – Mark Plotnick
    Commented Aug 30, 2014 at 7:11
  • 1
    I also see system calls rename and unlink in that audit log. The program may rely on having write access to a few of those directories. When it fails, the password you said it asks for may be for someone who does have write access.
    – Mark Plotnick
    Commented Aug 30, 2014 at 7:34
  • You may be using AppArmor or a similar MAC (Mandatory Access Control) system that enforces per-executable permissions beyond the filesystem permissions.
    – Giel
    Commented Aug 30, 2014 at 12:28
  • @Mark and @Giel: Added the information about AppArmor and path prefixes permission. Mark, could you give more informations about those rename and unlink calls?
    – Ramon Dantas
    Commented Aug 30, 2014 at 13:39
  • Look for the syscall=87 line. That's unlink. And the audit shows the directory is user 0, group 0, mode 755. If the process is running as you, it's not going to succeed with that unlink unless the directory is mode 777 or its owner is you or its group is a group you're a member of and its mode 775.
    – Mark Plotnick
    Commented Aug 30, 2014 at 14:09

2 Answers 2

Reset to default
9

First, when you add yourself to a group, the change is not applied immediately. The easiest thing is to logout and log back in.

Then there are write permissions of data files (as mentioned already in some of the comments). However, the solutions are not good for security.

  • Add a group for the game. Do not add any user to this group.
  • Make the game executable by chmod -R ugo+rX game-directory
  • Give write permissions to group only and no-one else using chmod -R ug+w,o-w game-directory
  • Add game to group chgrp -R game-group game-directory, chmod -R g+s game-directory

or just addgroup game-group; chgrp -R game-group game-directory; chmod -R u=rwX,g=rwXs,o=rX game-directory

If game needs to change permissions then you can do the same but for user instead of group. ie.

adduser game-owner; addgroup game-group; chown -R game-owner:game-group game-directory; chmod -R u=rwXs,g=rwXs,o=rX game-directory

Improve this answer
4
  • Thanks. It seems like the game wants to change file permissions, but doesn't wants it to be ran as root. That's strange. I think that I'll need to change it's owner to me, and update it, then return the ownership back to root.
    – Ramon Dantas
    Commented Aug 30, 2014 at 15:03
  • If it wants to change file permissions, then you will have to do as I described but for user instead of group. I will append to end of answer.
    – ctrl-alt-delor
    Commented Aug 30, 2014 at 15:57
  • 2
    never allow it to run as root, if you can not give it the correct permissions using traditional modes/group/users, then you may need Access Control Lists or capabilities. see unix.stackexchange.com/questions/101263/…
    – ctrl-alt-delor
    Commented Aug 30, 2014 at 16:02
  • Thanks , this solved it for me: The easiest thing is to logout and log back in.
    – gregn3
    Commented Jun 8, 2020 at 15:48
2

Directories need x bit set (for directory that bit is seen as search bit) to open. So I use tree so I can get only the folder set and avoid the nightmare of having all the files set as executables ( the option for tree is -d List directories only.):

sudo tree -faid here_goes_your_directory xargs -L1 -I{} sudo chmod 755  "{}"

Warning!!! you should have this into considerations:

  • using chmod or chown recursive on root / directory or system directories will destroy your OS (actually anything recursive on / directory or system directories is dangerous)

  • this is not a good security practice to set permission bulk like that

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .