4

I'm attempting to start a service that our company created. In one particular environment, it's failing to start on three "permission denied" errors. I'm not sure which files it is failing on, so I would like to log all permissions-related errors while I attempt to start the daemon.

I've found auditd, but I've been unable to place a watch on the whole disk for specifically permissions-related errors. What is the best way to audit all permissions-related errors?

1
  • If you created the service, why not install a debug version that does some more explicit error catching and tells you which files it tries to open at every step? The -vvv flag was invented for a reason. :) Apr 5, 2013 at 17:07

3 Answers 3

5

You could use strace to view all filesystem activity of the processes related to the daemon, and see which ones fail when the permission denied errors appear.

If the error comes from a shell script that starts the service, you can run sh -x /path/to/startup/script (or bash -x /path/to/startup/script if the script begins with #!/bin/bash) and the shell will print each line as it executes it.

2
  • Just start the process under strace and stuff to output somewhere (it tends to be large). Make sure strace follows children processes too. Later you can look for calls to open and such, asn see which ones fail.
    – vonbrand
    Apr 5, 2013 at 16:25
  • I've expanded on your answer.
    – zorlem
    Apr 6, 2013 at 0:43
4

You can try starting your service using strace and filter the output only to file-related operations. To see all children processes started by the service I suggest you try to start it with the following options:

strace -e trace=file -f /etc/init.d/your-service-startup-script start

This will produce a lot of output, so you can either forward it to a file using -o <log filename> after strace or pipe it through grep:

strace -e trace=file -f /etc/init.d/your-service-rc-script start 2>&1 | grep 'EACCES' 

This will display only file system calls that fail due to insufficient privileges (Permission denied). 2>&1 is necessary to redirect strace's stderr file descriptor to stdout for grep.

1

Check file permissions to run. Try:

chmod 7xx [scriptFile].

Also, ensure the file owner is the correct. Try:

chown group:user [scriptFile]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .