[solved] reflector: sudo creates cache file in user dir owned by root

karol · 2014-08-18 23:13:08

modedit: split from Reflector thread /Xyne

I have no problem with the change, it's just that people laugh at me for posting in NC: https://bbs.archlinux.org/viewtopic.php … 4#p1448174 ;-)
Rightfully so, since I was staring at the answer the whole time, but couldn't put 2 and 2 together ...

Both '-info' and '--info' return

$ reflector -info
error: failed to cache JSON data ([Errno 13] Permission denied: '/home/karol/.cache/mirrorstatus.json')

but after I run reflector with sudo

$ reflector -info
################################################################################
################# Arch Linux mirrorlist generated by Reflector #################
################################################################################

# With:       reflector -info
# When:       2014-08-18 23:07:57 UTC
# From:       https://www.archlinux.org/mirrors/status/json/
# Retrieved:  2014-08-18 23:07:43 UTC
# Last Check: 2014-08-18 22:54:36 UTC

'--info' returns the list of mirrors, as expected.

Last edited by karol (2014-08-22 11:16:22)

Xyne · 2014-08-19 02:13:31

Does root own /home/karol/.cache/mirrorstatus.json? When running with sudo, it should default to root's XDG_CACHE_HOME or a path in /tmp/ if that is unset:

def get_cache_file():
  bname = 'mirrorstatus.json'
  path = os.getenv('XDG_CACHE_HOME')
  if path:
    try:
      os.makedirs(path, exist_ok=True)
    # Raised if permissions do not match umask
    except FileExistsError:
      pass
    return os.path.join(path, bname)
  else:
    return '/tmp/.{}.{}'.format(getpass.getuser(), bname)

-info is parsed as -i nfo, i.e. it returns mirrors with "nfo" in the URL.

karol · 2014-08-19 04:40:37

$ reflector -info
error: failed to cache JSON data ([Errno 13] Permission denied: '/home/karol/.cache/mirrorstatus.json')
test $ ls -l /home/karol/.cache/mirrorstatus.json
-rw-r--r-- 1 root root 86116 Aug 19 01:07 /home/karol/.cache/mirrorstatus.json

chowning fixed it, but why was it owned by root?

Xyne · 2014-08-19 09:01:45

karol wrote:

chowning fixed it, but why was it owned by root?

Root's a %#$%&% kleptomaniac!

But really, I don't know. I suspect that there may be some "sudo" silliness where it preserves the user's XDG_CACHE_HOME while running as root. Let me know if you are able to reproduce it so that I can try to update reflector if necessary.

karol · 2014-08-19 13:24:48

Here you go. I removed /home/karol/.cache/mirrorstatus.json. If I run reflector w/o sudo first, the file is owned by karol, not by root and the ownership isn't changed after I run it with sudo. If I remove /home/karol/.cache/mirrorstatus.json and run 'sudo reflector -ixyz', the file is owned by root.

$ ls -l /home/karol/.cache/mirrorstatus.json
-rw-r--r-- 1 karol users 86121 Aug 19 15:13 /home/karol/.cache/mirrorstatus.json
$ rm -f /home/karol/.cache/mirrorstatus.json
$ reflector -ixyz
################################################################################
################# Arch Linux mirrorlist generated by Reflector #################
################################################################################

# With:       reflector -ixyz
# When:       2014-08-19 13:18:38 UTC
# From:       https://www.archlinux.org/mirrors/status/json/
# Retrieved:  2014-08-19 13:18:38 UTC
# Last Check: 2014-08-19 13:08:20 UTC


$ ls -l /home/karol/.cache/mirrorstatus.json
-rw-r--r-- 1 karol users 86121 Aug 19 15:18 /home/karol/.cache/mirrorstatus.json
$ sudo reflector -ixyz
################################################################################
################# Arch Linux mirrorlist generated by Reflector #################
################################################################################

# With:       reflector -ixyz
# When:       2014-08-19 13:18:47 UTC
# From:       https://www.archlinux.org/mirrors/status/json/
# Retrieved:  2014-08-19 13:18:38 UTC
# Last Check: 2014-08-19 13:08:20 UTC


$ ls -l /home/karol/.cache/mirrorstatus.json
-rw-r--r-- 1 karol users 86121 Aug 19 15:18 /home/karol/.cache/mirrorstatus.json
$ rm -f /home/karol/.cache/mirrorstatus.json
$ sudo reflector -ixyz
################################################################################
################# Arch Linux mirrorlist generated by Reflector #################
################################################################################

# With:       reflector -ixyz
# When:       2014-08-19 13:19:02 UTC
# From:       https://www.archlinux.org/mirrors/status/json/
# Retrieved:  2014-08-19 13:19:02 UTC
# Last Check: 2014-08-19 13:08:20 UTC


$ ls -l /home/karol/.cache/mirrorstatus.json
-rw-r--r-- 1 root root 86121 Aug 19 15:19 /home/karol/.cache/mirrorstatus.json
$ reflector -ixyz --cache-timeout 1
error: failed to cache JSON data ([Errno 13] Permission denied: '/home/karol/.cache/mirrorstatus.json')

Last edited by karol (2014-08-19 13:25:36)

Xyne · 2014-08-20 02:55:51

I don't understand this. root's XDG_CACHE_HOME should be different from karol's. What shell are you using?

Can you post the output of the following script run as karol with and without sudo?

#!/usr/bin/env python3

import os
import pwd

for i, uid in zip('res', os.getresuid()):
  print('{}uid: {}'.format(i, pwd.getpwuid(uid)[0]))
for envvar in ('SUDO_USER', 'XDG_CACHE_HOME'):
  print('{}: {}'.format(envvar, os.getenv(envvar)))

Here's my output using a bash shell:

$ ./test.py 
ruid: xyne
euid: xyne
suid: xyne
SUDO_USER: None
XDG_CACHE_HOME: /home/xyne/.cache

$ sudo ./test.py 
ruid: root
euid: root
suid: root
SUDO_USER: xyne
XDG_CACHE_HOME: None

karol · 2014-08-20 19:07:03

$ ./test.py
ruid: karol
euid: karol
suid: karol
SUDO_USER: None
XDG_CACHE_HOME: /home/karol/.cache

$ sudo ./test.py
ruid: root
euid: root
suid: root
SUDO_USER: karol
XDG_CACHE_HOME: /home/karol/.cache

# echo $XDG_CACHE_HOME
/home/karol/.cache

I changed it to

# echo $XDG_CACHE_HOME
/home/root/.cache
# ./test.py
ruid: root
euid: root
suid: root
SUDO_USER: None
XDG_CACHE_HOME: /home/root/.cache

but the issue persists:

$ sudo ./test.py
ruid: root
euid: root
suid: root
SUDO_USER: karol
XDG_CACHE_HOME: /home/karol/.cache

Maybe you should move the last few posts to a new thread? If I have misconfigured my system, there's no point in polluting this thread.

Xyne · 2014-08-20 21:20:00

karol wrote:

I changed it to

# echo $XDG_CACHE_HOME
/home/root/.cache
# ./test.py
ruid: root
euid: root
suid: root
SUDO_USER: None
XDG_CACHE_HOME: /home/root/.cache

but the issue persists:

$ sudo ./test.py
ruid: root
euid: root
suid: root
SUDO_USER: karol
XDG_CACHE_HOME: /home/karol/.cache

How did you change it? Are you sure that the changes have propagated to the shell in which you are running sudo?

This does indeed seem to be a configuration problem. I had an idea for a workaround to compare the values of XDG_CACHE_HOME with different EUIDs but the environment appears to be fixed when passed to the process (which would have been expected if I had thought about it). You can test it with this script.

#!/usr/bin/env python3

import os
import pwd

XCH = 'XDG_CACHE_HOME'
SU = 'SUDO_USER'

def print_info(qualifier=None):
  for i, uid in zip('res', os.getresuid()):
    print('{}uid: {}'.format(i, pwd.getpwuid(uid)[0]))
  xch = os.getenv(XCH)
  if qualifier:
    qualifier = ' [{}]'.format(qualifier)
  print('{}{}: {}\n'.format(XCH, qualifier, xch))

print_info('default')

su = os.getenv(SU)
if su:
  print('{}: {}'.format(SU, su))
  pw = pwd.getpwnam(su)

  uid = os.geteuid()
  os.seteuid(pw[2])
  print_info('seteuid')
  os.seteuid(uid)

  uid = os.getuid()
  os.setuid(pw[2])
  print_info('setuid')
#   os.setuid(uid)

It seems that the only way to change the behavior is to ensure that the process receives the correct value of XDG_CACHE_HOME (or no value).

karol wrote:

Maybe you should move the last few posts to a new thread? If I have misconfigured my system, there's no point in polluting this thread.

Done.

karol · 2014-08-20 22:53:51

Xyne wrote:

How did you change it? Are you sure that the changes have propagated to the shell in which you are running sudo?

For some reason root had the wrong XDG_CACHE_HOME set in his .bashrc. Is OK to export such settings from ~/.bashrc?
After making the changes I've used a new shell from a freshly-spawned tty.

$ ./test2.py
ruid: karol
euid: karol
suid: karol
XDG_CACHE_HOME [default]: /home/karol/.cache

$ sudo ./test2.py
ruid: root
euid: root
suid: root
XDG_CACHE_HOME [default]: /home/karol/.cache

SUDO_USER: karol
ruid: root
euid: karol
suid: root
XDG_CACHE_HOME [seteuid]: /home/karol/.cache

ruid: karol
euid: karol
suid: karol
XDG_CACHE_HOME [setuid]: /home/karol/.cache

It's not a huge problem and I've never been bitten by it, I'll be careful not to report such issues as bugs.

Last edited by karol (2014-08-20 22:56:20)

Xyne · 2014-08-21 00:31:08

karol wrote:

Is OK to export such settings from ~/.bashrc?

I expect that to work, but I don't actually know how sudo sets up the target user's environment.

I'm perplexed by this. The only solution that comes to mind is a wrapper script or alias to set XDG_CACHE_HOME and then invoke reflector with

XDG_CACHE_HOME="$some_path" reflector "$@"

I hope someone else can explain wtf is going on.

karol · 2014-08-21 13:02:45

If I unset XDG_CACHE_HOME or set it to a different path in /home/karol/.bashrc, it changes not just for karol but for sudo too.
Ho did you set yours, since it works on your system?

Xyne · 2014-08-21 23:03:24

I have

export XDG_CACHE_HOME="$HOME/.cache"

in ~/.bash_profile.

karol · 2014-08-21 23:28:02

Tried that already.
Turns out

Defaults      !env_reset

in my /etc/sudoers is to blame. When I changed it to

Defaults      env_reset

sudo let go of my cache:

$ ./test.py
ruid: karol
euid: karol
suid: karol
SUDO_USER: None
XDG_CACHE_HOME: /home/karol/.cache
test $ sudo ./test.py
ruid: root
euid: root
suid: root
SUDO_USER: karol
XDG_CACHE_HOME: None

Edit: I've been using 'Defaults !env_reset' because I was too lazy to copy my ~/.vimrc to /home/root and the colorscheme to /home/root/.vim/colors/ ;P

Should I mark the thread solved or do you want to check something?

Last edited by karol (2014-08-21 23:35:45)

Xyne · 2014-08-22 01:19:02

Now that we have understood the issue it seems that everything is working as expected, so go ahead and mark it solved.

karol · 2014-08-22 11:17:05

Thanks for all the help, Xyne :-)

Arch Linux

#1 2014-08-18 23:13:08

[solved] reflector: sudo creates cache file in user dir owned by root

#2 2014-08-19 02:13:31

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#3 2014-08-19 04:40:37

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#4 2014-08-19 09:01:45

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#5 2014-08-19 13:24:48

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#6 2014-08-20 02:55:51

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#7 2014-08-20 19:07:03

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#8 2014-08-20 21:20:00

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#9 2014-08-20 22:53:51

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#10 2014-08-21 00:31:08

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#11 2014-08-21 13:02:45

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#12 2014-08-21 23:03:24

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#13 2014-08-21 23:28:02

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#14 2014-08-22 01:19:02

Re: [solved] reflector: sudo creates cache file in user dir owned by root

#15 2014-08-22 11:17:05

Re: [solved] reflector: sudo creates cache file in user dir owned by root

Board footer