1

I have a problem that the access permissions for group and world access on the /srv directory get reverted on reboot.

Whenever I grant the world write access using sudo chmod a+rwx /srv then all is well, except that after a reboot, the permissions revert back to the old permissions.

I can reproduce this with a fresh Linux Mint 18 installation in VirtualBox.

After some more testing, it seems that the permissions of /dev, /home, /proc, /run, /sys and /var are reset after reboot as well.

The directories /bin, /boot, /cdrom, /etc, /lib, /lib64, /lost+found, /media, /mnt, /opt, /root, /sbin, /tmp and /usr are not affected.

I also tried removing all scripts in /etc/init.d, in the hope to pinpoint a "smart" init script, but permissions still got reset after reboot. Mint 18 apparently uses systemd by default, I did not try to remove the systemd scripts as that would probably just break the system.

I checked the mount output to see if something strange was mounted, this was not the case as far as I could see (Mount output below).

I tried to reproduce this phenomena with the slightly older Linux Mint 17.3 which I have been using for some time without problems. It seems Mint 17.3 also resets permissions, but not on the /srv directory. For completeness, it does reset /dev, /proc, /run and /sys.

Hoping to get a clue where to search for, I replaced /bin/chmod with a shell script calling the "real" chmod, the shell script additionally logs the chmod call with its parameters to a file on disk. Unfortunately no calls got logged except for my own chmod a+rwx * test call.

So I get the feeling some application binary is trying to be smart and "fix" the permissions for me, but which one?

Anybody an idea?

ls -l output just after installation:

user@system / $ ls -l /
total 96
drwxr-xr-x   2 root root  4096 Feb  6 20:50 bin
drwxr-xr-x   3 root root  4096 Feb  6 20:50 boot
drwxr-xr-x   2 root root  4096 Feb  6 20:46 cdrom
drwxr-xr-x  19 root root  4240 Feb  6 20:51 dev
drwxr-xr-x 150 root root 12288 Feb  6 20:50 etc
drwxr-xr-x   3 root root  4096 Feb  6 20:46 home
lrwxrwxrwx   1 root root    32 Feb  6 20:50 initrd.img -> boot/initrd.img-4.4.0-21-generic
drwxr-xr-x  25 root root  4096 Feb  6 20:50 lib
drwxr-xr-x   2 root root  4096 Jun 28  2016 lib64
drwx------   2 root root 16384 Feb  6 20:44 lost+found
drwxr-xr-x   2 root root  4096 Jun 28  2016 media
drwxr-xr-x   2 root root  4096 Jun 28  2016 mnt
drwxr-xr-x   2 root root  4096 Jun 28  2016 opt
dr-xr-xr-x 173 root root     0 Feb  6  2017 proc
drwx------   4 root root  4096 Feb  6 20:51 root
drwxr-xr-x  30 root root   940 Feb  6 20:51 run
drwxr-xr-x   2 root root 12288 Feb  6 20:50 sbin
drwxr-xr-x   2 root root  4096 Jun 28  2016 srv
dr-xr-xr-x  13 root root     0 Feb  6 20:51 sys
drwxrwxrwt  10 root root  4096 Feb  6 20:51 tmp
drwxr-xr-x  10 root root  4096 Jun 28  2016 usr
drwxr-xr-x  11 root root  4096 Jun 28  2016 var
lrwxrwxrwx   1 root root    29 Feb  6 20:50 vmlinuz -> boot/vmlinuz-4.4.0-21-generic
user@system / $

ls -l output after sudo chmod a+rwx *

user@system / $ ls -lah
total 96
drwxrwxrwx   2 root root  4096 Feb  6 20:50 bin
drwxrwxrwx   3 root root  4096 Feb  6 20:50 boot
drwxrwxrwx   2 root root  4096 Feb  6 20:46 cdrom
drwxrwxrwx  19 root root  4240 Feb  6 20:51 dev
drwxrwxrwx 150 root root 12288 Feb  6 20:50 etc
drwxrwxrwx   3 root root  4096 Feb  6 20:46 home
lrwxrwxrwx   1 root root    32 Feb  6 20:50 initrd.img -> boot/initrd.img-4.4.0-21-generic
drwxrwxrwx  25 root root  4096 Feb  6 20:50 lib
drwxrwxrwx   2 root root  4096 Jun 28  2016 lib64
drwxrwxrwx   2 root root 16384 Feb  6 20:44 lost+found
drwxrwxrwx   2 root root  4096 Jun 28  2016 media
drwxrwxrwx   2 root root  4096 Jun 28  2016 mnt
drwxrwxrwx   2 root root  4096 Jun 28  2016 opt
drwxrwxrwx 167 root root     0 Feb  6  2017 proc
drwxrwxrwx   4 root root  4096 Feb  6 20:51 root
drwxrwxrwx  30 root root   960 Feb  6 20:56 run
drwxrwxrwx   2 root root 12288 Feb  6 20:50 sbin
drwxrwxrwx   2 root root  4096 Jun 28  2016 srv
drwxrwxrwx  13 root root     0 Feb  6 20:51 sys
drwxrwxrwt  10 root root  4096 Feb  6 20:56 tmp
drwxrwxrwx  10 root root  4096 Jun 28  2016 usr
drwxrwxrwx  11 root root  4096 Jun 28  2016 var
lrwxrwxrwx   1 root root    29 Feb  6 20:50 vmlinuz -> boot/vmlinuz-4.4.0-21-generic
user@system / $ 

After reboot: (Just to be sure, i did a manual sync before rebooting)

user@system / $ ls -l
total 96
drwxrwxrwx   2 root root  4096 Feb  6 20:50 bin
drwxrwxrwx   3 root root  4096 Feb  6 20:50 boot
drwxrwxrwx   2 root root  4096 Feb  6 20:46 cdrom
drwxr-xr-x  19 root root  4240 Feb  6 20:57 dev
drwxrwxrwx 150 root root 12288 Feb  6 20:50 etc
drwxr-xr-x   3 root root  4096 Feb  6 20:46 home
lrwxrwxrwx   1 root root    32 Feb  6 20:50 initrd.img -> boot/initrd.img-4.4.0-21-generic
drwxrwxrwx  25 root root  4096 Feb  6 20:50 lib
drwxrwxrwx   2 root root  4096 Jun 28  2016 lib64
drwxrwxrwx   2 root root 16384 Feb  6 20:44 lost+found
drwxrwxrwx   2 root root  4096 Jun 28  2016 media
drwxrwxrwx   2 root root  4096 Jun 28  2016 mnt
drwxrwxrwx   2 root root  4096 Jun 28  2016 opt
dr-xr-xr-x 177 root root     0 Feb  6  2017 proc
drwxrwxrwx   4 root root  4096 Feb  6 20:51 root
drwxr-xr-x  29 root root   920 Feb  6 20:57 run
drwxrwxrwx   2 root root 12288 Feb  6 20:50 sbin
drwxr-xr-x   2 root root  4096 Jun 28  2016 srv
dr-xr-xr-x  13 root root     0 Feb  6 20:57 sys
drwxrwxrwt  10 root root  4096 Feb  6 20:57 tmp
drwxrwxrwx  10 root root  4096 Jun 28  2016 usr
drwxr-xr-x  11 root root  4096 Jun 28  2016 var
lrwxrwxrwx   1 root root    29 Feb  6 20:50 vmlinuz -> boot/vmlinuz-4.4.0-21-generic
user@system / $

mount output:

user@system / $ mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=1132716k,nr_inodes=283179,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=230660k,mode=755)
/dev/sda1 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /sys/fs/cgroup type tmpfs (rw,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd,nsroot=/)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb,release_agent=/run/cgmanager/agents/cgm-release-agent.hugetlb,nsroot=/)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer,nsroot=/)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct,nsroot=/)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory,nsroot=/)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset,clone_children,nsroot=/)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio,nsroot=/)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event,release_agent=/run/cgmanager/agents/cgm-release-agent.perf_event,nsroot=/)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids,release_agent=/run/cgmanager/agents/cgm-release-agent.pids,nsroot=/)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio,nsroot=/)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices,nsroot=/)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=32,pgrp=1,timeout=0,minproto=5,maxproto=5,direct)
mqueue on /dev/mqueue type mqueue (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime)
cgmfs on /run/cgmanager/fs type tmpfs (rw,relatime,size=100k,mode=755)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=230660k,mode=700,uid=1000,gid=1000)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
user@system / $

PS While normally having the /srv directory world writable is probably a bad idea, in my case I have a separate system in a firewalled environment for embedded development purposes.

  • 1
    You could try making /srv immutable (chattr +i /srv), and check post-reboot logs for anything complaining about not being able to reset it. – DopeGhoti Feb 6 '17 at 21:17
  • Good hint, thanks! Syslog now complains: systemd-tmpfiles[517]: chmod(/srv) failed: Operation not permitted - Now I can zero in on the problem. – Zweater Feb 6 '17 at 21:37
2

The permissions were set by systemd-tmpfiles which seems to be documented here.

I could solve it by editing /usr/lib/tmpfiles.d/home.conf, I placed a comment before the line q /srv 0755 - - -

With thanks to DopeGhoti for helping to pinpoint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.