Bug 808801 – sys-apps/usbguard-1.0.0-r2 crashes at start (require directory /etc/usbguard/IPCAccessControl.d/)

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Bogdan 2021-08-17 23:04:33 UTC]

Daemon require directory /etc/usbguard/IPCAccessControl.d/ to start.
rc-service usbguard-dbus start

Reproducible: Always

Steps to Reproduce:
1. emerge usbguard
2. rc-service usbguard start

Actual Results:  
rc-service usbguard start
usbguard             | * Starting usbguard ...                                                                        
usbguard             | * start-stop-daemon: /usr/sbin/usbguard-daemon died                                            
usbguard             | * Failed to start usbguard                                                               [ !! ]
usbguard             | * ERROR: usbguard failed to start

Expected Results:  
rc-service usbguard start
usbguard             | * Starting usbguard ...

Manual start says:

/usr/sbin/usbguard-daemon -k -c /etc/usbguard/usbguard-daemon.conf
[1629240279.848] (E) getConfigsFromDir: opendir: /etc/usbguard/IPCAccessControl.d/: No such file or directory

Syslog has no messages about usbguard crashes:

cat /var/log/messages | grep -i usbguard
Aug 18 02:02:54 localhost /etc/init.d/usbguard[328544]: start-stop-daemon: /usr/sbin/usbguard-daemon died
Aug 18 02:02:54 localhost /etc/init.d/usbguard[328470]: ERROR: usbguard failed to start

[Comment 1 Bogdan 2021-08-17 23:05:27 UTC]

To fix bug, ebuild must contains instruction to create /etc/usbguard/IPCAccessControl.d/ directory.

[Comment 2 Sebastian Pipping 2021-08-18 11:16:37 UTC]

Hi Bogdan, thanks for the report!

[Comment 3 Larry the Git Cow 2021-08-18 11:17:20 UTC]

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9dc9bf3c02298f279114fd220e46328b3e0b200f

commit 9dc9bf3c02298f279114fd220e46328b3e0b200f
Author:     Sebastian Pipping <[e-mail]>
AuthorDate: 2021-08-18 11:15:29 +0000
Commit:     Sebastian Pipping <[e-mail]>
CommitDate: 2021-08-18 11:15:43 +0000

    sys-apps/usbguard: Keepdir /etc/usbguard/IPCAccessControl.d
    
    Closes: https://bugs.gentoo.org/808801
    Signed-off-by: Sebastian Pipping <[e-mail]>
    Package-Manager: Portage-3.0.20, Repoman-3.0.3

 sys-apps/usbguard/usbguard-1.0.0-r3.ebuild | 101 +++++++++++++++++++++++++++++
 1 file changed, 101 insertions(+)

[Comment 4 Dennis Schridde 2021-08-23 12:28:09 UTC]

(In reply to Larry the Git Cow from comment #3)
> The bug has been closed via the following commit(s):
> 
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=9dc9bf3c02298f279114fd220e46328b3e0b200f
> 
> commit 9dc9bf3c02298f279114fd220e46328b3e0b200f
> Author:     Sebastian Pipping <[e-mail]>
> AuthorDate: 2021-08-18 11:15:29 +0000
> Commit:     Sebastian Pipping <[e-mail]>
> CommitDate: 2021-08-18 11:15:43 +0000
> 
>     sys-apps/usbguard: Keepdir /etc/usbguard/IPCAccessControl.d
>     
>     Closes: https://bugs.gentoo.org/808801
>     Signed-off-by: Sebastian Pipping <[e-mail]>
>     Package-Manager: Portage-3.0.20, Repoman-3.0.3
> 
>  sys-apps/usbguard/usbguard-1.0.0-r3.ebuild | 101
> +++++++++++++++++++++++++++++
>  1 file changed, 101 insertions(+)

Now I get:

systemd[1]: Starting USBGuard daemon...
usbguard-daemon[1168]: [1629721293.729] (E) Permissions for /etc/usbguard/IPCAccessControl.d//.keep_sys-apps_usbguard-0 should be 0600
usbguard-daemon[1168]: [1629721293.730] (E) Check permissions: /etc/usbguard/IPCAccessControl.d//.keep_sys-apps_usbguard-0: Policy may be readable
usbguard-daemon[1168]: Permissions for /etc/usbguard/IPCAccessControl.d//.keep_sys-apps_usbguard-0 should be 0600
usbguard-daemon[1168]: Check permissions: /etc/usbguard/IPCAccessControl.d//.keep_sys-apps_usbguard-0: Policy may be readable
systemd[1]: usbguard.service: Control process exited, code=exited, status=1/FAILURE
systemd[1]: usbguard.service: Failed with result 'exit-code'.
systemd[1]: Failed to start USBGuard daemon.

This is quickly fixed:

# chmod 0600 /etc/usbguard/IPCAccessControl.d/.keep_sys-apps_usbguard-0

[Comment 5 Sebastian Pipping 2021-08-23 15:44:10 UTC]

Oh shoot, thanks for the update.  I confirm that after the chmod this turns into…

  [1629733331.885] (W) Ignoring access control file because of malformed name: .keep_sys-apps_usbguard-0

…and the daemon starts up.  I'll remove -r3 and add -r4 in a minute.

[Comment 6 Larry the Git Cow 2021-08-23 15:47:46 UTC]

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=36dc7acff514d9d4e1a16b01b87e7edf4973ef1f

commit 36dc7acff514d9d4e1a16b01b87e7edf4973ef1f
Author:     Sebastian Pipping <[e-mail]>
AuthorDate: 2021-08-23 15:45:14 +0000
Commit:     Sebastian Pipping <[e-mail]>
CommitDate: 2021-08-23 15:46:50 +0000

    sys-apps/usbguard: Fix troublesome keepdir file perms
    
    Closes: https://bugs.gentoo.org/808801
    Signed-off-by: Sebastian Pipping <[e-mail]>
    Package-Manager: Portage-3.0.22, Repoman-3.0.3

 sys-apps/usbguard/{usbguard-1.0.0-r3.ebuild => usbguard-1.0.0-r4.ebuild} | 1 +
 1 file changed, 1 insertion(+)