0

I must be missing something. I created a service account that will run a script I created as a cron job. The script links files to be processed to a watched folder. The script worked fine running as root, but I thought it was best to use a service account and have the cron job run hourly under that account. Now I'm running into permissions issues when I try to create files/folders as the service account.

[root@analysis ~]# ls -l /watched/robert.sicko/

total 24  
drwxrwx--- 20 srvArcherNBS srvArcherNBS 20480 May  8 11:35 XXX  
drwxrwx---  2 srvArcherNBS srvArcherNBS  4096 May  4 11:04 test

[root@analysis ~]# su -c "touch /watched/robert.sicko/test/abc.completed" srvArcherNBS

touch: cannot touch `/watched/robert.sicko/test/abc.completed': Permission denied

Other info. The server runs CentOS release 6.10. watched, robert.sicko and test directories already existed, I changed ownership of /watched/robert.sicko/* to the service account with:

chown -R srvArcherNBS:srvArcherNBS /watched/robert.sicko/*

the /watched dir isn't owned by srvArcherNBS, but changing the group of /watched and /watched/robert.sicko to srvArcherNBS didn't change anything

[root@analysis watched]# ls -l
total 4
drwxrwx--- 4 apache archer_daemon_web_access 4096 May  4 11:04 robert.sicko

edit to add result of ls /watched/robert.sicko/test/abc.completed:

[root@analysis /]# ls -l /watched/robert.sicko/test/abc.completed
ls: cannot access /watched/robert.sicko/test/acb.completed: No such file or directory

edit2 to add to the weirdness - running ls with su as srvArcherNBS gets permission denied but if I su srvArcherNBS, I can then ls.

[root@analysis robert.sicko]# pwd
/var/www/analysis/watched/robert.sicko
[root@analysis robert.sicko]# su -c "ls -la /var/www/analysis/watched/robert.sicko" srvArcherNBS
ls: cannot access /var/www/analysis/watched/robert.sicko: Permission denied
[root@analysis robert.sicko]# su srvArcherNBS
[srvArcherNBS@analysis robert.sicko]$ ls -la
total 32
drwxrwx---  4 apache       srvArcherNBS  4096 May  4 11:04 .
drwxrwx---  3 apache       srvArcherNBS  4096 Mar 27  2019 ..
drwxrwx--- 22 srvArcherNBS srvArcherNBS 20480 May  8 15:10 XXX
drwxrwx---  2 srvArcherNBS srvArcherNBS  4096 May  4 11:04 test
[srvArcherNBS@analysis robert.sicko]$

output of mount

[root@analysis robert.sicko]# mount
/dev/mapper/VolGroup-lv_root on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw)
/dev/sda1 on /boot type ext4 (rw)
/dev/mapper/VolGroup-lv_home on /home type ext4 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
//prd/agtcnbs on /mnt/agtcnbs type cifs (rw             )
8
  • Please add ls -l /watched/robert.sicko/test/abc.completed and its result to your question – roaima May 8 '20 at 17:58
  • What kind of filesystem is /watched? – Joseph Sible-Reinstate Monica May 8 '20 at 18:41
  • looks like it's ext4 – Robert Sicko May 8 '20 at 19:04
  • Are you sure that you're not using NFS or something? What does mount say? – Joseph Sible-Reinstate Monica May 11 '20 at 18:53
  • I added the output of mount – Robert Sicko May 11 '20 at 18:57
0

I ended up solving this by changing permissions on the directories in the tree:

 /var/www/analysis/watched/robert.sicko

I have to give others r+x permissions on var www etc. even though I had group permission set to rwx for the directory I was trying to write in. I don't fully understand it, but it still seems safer than having my cron job run as root.

Not the answer you're looking for? Browse other questions tagged or ask your own question.