3

I'm attempting to start a service that our company created. In one particular environment, it's failing to start on three "permission denied" errors. I'm not sure which files it is failing on, so I would like to log all permissions-related errors while I attempt to start the daemon.

I've found auditd, but I've been unable to place a watch on the whole disk for specifically permissions-related errors. What is the best way to audit all permissions-related errors?

  • If you created the service, why not install a debug version that does some more explicit error catching and tells you which files it tries to open at every step? The -vvv flag was invented for a reason. :) – Shadur Apr 5 '13 at 17:07
5

You could use strace to view all filesystem activity of the processes related to the daemon, and see which ones fail when the permission denied errors appear.

If the error comes from a shell script that starts the service, you can run sh -x /path/to/startup/script (or bash -x /path/to/startup/script if the script begins with #!/bin/bash) and the shell will print each line as it executes it.

  • Just start the process under strace and stuff to output somewhere (it tends to be large). Make sure strace follows children processes too. Later you can look for calls to open and such, asn see which ones fail. – vonbrand Apr 5 '13 at 16:25
  • I've expanded on your answer. – zorlem Apr 6 '13 at 0:43
3

You can try starting your service using strace and filter the output only to file-related operations. To see all children processes started by the service I suggest you try to start it with the following options:

strace -e trace=file -f /etc/init.d/your-service-startup-script start

This will produce a lot of output, so you can either forward it to a file using -o <log filename> after strace or pipe it through grep:

strace -e trace=file -f /etc/init.d/your-service-rc-script start 2>&1 | grep 'EACCES' 

This will display only file system calls that fail due to insufficient privileges (Permission denied). 2>&1 is necessary to redirect strace's stderr file descriptor to stdout for grep.

0

Check file permissions to run. Try:

chmod 7xx [scriptFile].

Also, ensure the file owner is the correct. Try:

chown group:user [scriptFile]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.