0

We have our application server (glassfish 4) running under the user glassfish. We have our solr 5 server running under the user solr. Both glassfish and solr are running on the same physical server.

An application that runs within glassfish needs to be able to create a solr core. To do this, 1) the application copies a predefined solr configuration into the /var/solr/data directory. 2) Issues a solr command through the REST API to create the solr core.

However, the folder is owned by glassfish with the permissions 0755. Due to these permissions the solr user cannot create a data directory and create the core correctly.

If I manually set the folder that is uploaded to 0777 and create the core, the core is created successfully.

What would be the most appropriate way of solving this?

I would expect solr to have a mechanism to handle this type of situation, but I can't seem to find anything.

1

You could add the user solr to the group assigned to the /var/solr/data directory, or make your own group containing both the solr and glassfish users and change the group assigned to the directory to this new group. That way you will only need to set 775 permissions on the directory.

Alternatively you can use file access lists to grant additional user or group level permissions. First check to see if FACLs are enabled with the command sudo tune2fs -l /dev/[fs identifier] | grep -i "default mount options". If acl is not an option on the right you will need to enable FACLs using sudo tune2fs -o acl /dev/[fs identifier], and then reboot or remount the filesystem. When FACLs are enabled, you can grant additional permissions with the setfacl command; so adding an additional user would be setfacl -m "u:[username]:[permissions]" [file/directory] where [permissions] are any combination of rwx and [file/directory] can be either the absolute or relative path. So for example, setfacl -m "u:solr:rwx" /var/solr/data would grant the solr user full permissions to the folder.

And, just for completion, you can know which files have a FACL set by the + that will appear after the normal permissions listed when you do a ls -l. Then you can use the getfacl command on the file to view the additional permissions it has. The -x flag on the setfacl command is used to remove entries i nthe FACL list.

  • Thanks. Your first suggestion is probably the route I am going to take. – Kevin Vasko Aug 30 '17 at 15:26
  • I ended up doing your first suggestion. The alternate is overkill for my purpose but good to know. – Kevin Vasko Sep 5 '17 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.