After installing etcd, I am unable to start its service unless I manually fix its var/lib permissions Reproducible: Always Steps to Reproduce: 1. Install dev-db/etcd 2. systemctl start etcd 3. Actual Results: etcd service won't start. From journalctl: Dec 27 20:08:30 xxxxxx etcd[194084]: cannot access data directory: directory "/var/lib/etcd","drwxr-xr-x" exist without desired file permission "-rwx------". Expected Results: etcd should start. # emerge --info dev-db/etcd Portage 3.0.12 (python 3.8.7-final-0, default/linux/amd64/17.1/no-multilib, gcc-10.2.0, glibc-2.32-r6, 5.10.3-gentoo x86_64) ================================================================= System Settings ================================================================= System uname: Linux-5.10.3-gentoo-x86_64-Intel-R-_Core-TM-_i7-4770_CPU_@_3.40GHz-with-glibc2.2.5 KiB Mem: 32791232 total, 29037648 free KiB Swap: 0 total, 0 free Timestamp of repository gentoo: Sun, 27 Dec 2020 04:00:01 +0000 Head commit of repository gentoo: 36781efd38eb25f8e0d4643af2c44029f61f702c sh bash 5.1_p4 ld GNU ld (Gentoo 2.35.1 p2) 2.35.1 app-shells/bash: 5.1_p4::gentoo dev-lang/perl: 5.30.3-r1::gentoo dev-lang/python: 2.7.18-r5::gentoo, 3.8.7::gentoo dev-util/cmake: 3.19.2::gentoo sys-apps/baselayout: 2.7-r1::gentoo sys-apps/sandbox: 2.20::gentoo sys-devel/autoconf: 2.13-r1::gentoo, 2.69-r5::gentoo sys-devel/automake: 1.16.3-r1::gentoo sys-devel/binutils: 2.35.1-r1::gentoo sys-devel/gcc: 10.2.0-r4::gentoo sys-devel/gcc-config: 2.3.2-r1::gentoo sys-devel/libtool: 2.4.6-r6::gentoo sys-devel/make: 4.3::gentoo sys-kernel/linux-headers: 5.10::gentoo (virtual/os-headers) sys-libs/glibc: 2.32-r6::gentoo Repositories: gentoo location: /var/db/repos/gentoo sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-max-age: 24 sync-rsync-verify-metamanifest: yes sync-rsync-verify-jobs: 1 sync-rsync-extra-opts: ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-flto=7 -O3 -march=haswell -pipe -fgraphite-identity -floop-nest-optimize -fipa-pta" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-flto=7 -O3 -march=haswell -pipe -fgraphite-identity -floop-nest-optimize -fipa-pta" DISTDIR="/var/cache/distfiles" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-flto=7 -O3 -march=haswell -pipe -fgraphite-identity -floop-nest-optimize -fipa-pta" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-flto=7 -O3 -march=haswell -pipe -fgraphite-identity -floop-nest-optimize -fipa-pta" GENTOO_MIRRORS="https://mirror.leaseweb.com/gentoo/" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j7" PKGDIR="/var/cache/binpkgs" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" USE="X a52 aac acl acpi alsa amd64 apache2 apng appindicator aspell bash-completion berkdb bidi bmp boost bzip2 clang cli crypt curl dbus dri dvd dvdr egl exif fdk ffmpeg flac fontconfig fortran fribidi gdbm gif gpm graphite gstreamer harfbuzz iconv icu jpeg kde lame libglvnd libtirpc lm-sensors lto luajit matroska mp3 mp4 mpeg mtp ncurses networkmanager nls nptl ogg opengl openmp pam pcre pcre16 pdf pgo phonon png policykit postproc pulseaudio qml qt5 raw readline seccomp sound sox spell split-usr ssl startup-notification svg symlink system-av1 system-binutils system-boost system-bootloader system-bootstrap system-cairo system-clang system-cmark system-crontab system-digest system-ffmpeg system-harfbuzz system-heimdal system-icu system-ipxe system-jpeg system-jsoncpp system-lcms system-leveldb system-libevent system-libs system-libvpx system-libyaml system-llvm system-lua system-lz4 system-mathjax system-mitkrb5 system-qemu system-seabios system-snappy system-sqlite system-ssl system-tbb system-uulib system-webp system-zlib systemd taglib tcl tcpd threads truetype udisks unicode upower usb user-session v4l vdpau vim-syntax vorbis wav wayland webp wget widgets x264 x265 xattr xvfb xvid zlib" ABI_X86="64" ADA_TARGET="gnat_2018" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 f16c fma3 mmx mmxext pclmul popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" CURL_SSL="openssl" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="libinput" KERNEL="linux" L10N="en" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LLVM_TARGETS="X86" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-2 php7-3 php7-4" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_8" PYTHON_TARGETS="python3_8" RUBY_TARGETS="ruby27" USERLAND="GNU" VIDEO_CARDS="intel i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LINGUAS, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS ================================================================= Package Settings ================================================================= dev-db/etcd-3.4.11::gentoo was built with the following: USE="server -doc"
We really need a feature to force overwrite of existing permissions, and this is what bug 654138 is about.
If we want to do a chown in pkg_preinst or postinst, then we need to be careful to avoid a root privilege escalation via "chown -R" as in bug 630972.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f6c88e3fe2e538eb9854d74f1d5f2a46c5e91190 commit f6c88e3fe2e538eb9854d74f1d5f2a46c5e91190 Author: Marcos Rodrigues Gonzalez <mrgonzalez1275@gmail.com> AuthorDate: 2022-02-10 02:11:53 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2022-02-10 02:25:20 +0000 dev-db/etcd: fix tmpfile permission for /var/lib Closes: https://bugs.gentoo.org/761954 Closes: https://github.com/gentoo/gentoo/pull/24140 Package-Manager: Portage-3.0.30, Repoman-3.0.3 Signed-off-by: Marcos Rodrigues Gonzalez <mrgonzalez1275@gmail.com> Signed-off-by: Zac Medico <zmedico@gentoo.org> dev-db/etcd/files/etcd.tmpfiles.d.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
