创建文件夹时 Systemd 权限被拒绝

创建文件夹时 Systemd 权限被拒绝

我正在尝试安装InfluxDB 2.0并按照指示这里Centos 7。因此,我的服务文件是:/lib/systemd/system/influxdb.service其内容是:

[Unit]
Description=InfluxDB 2.0 service file.
Documentation=https://v2.docs.influxdata.com/v2.0/get-started/
After=network-online.target

[Service]
User=influxdb
Group=influxdb
ExecStart=/usr/local/bin/influxd
Restart=on-failure

[Install]
WantedBy=multi-user.target

ls修改文件:

[vagrant@localhost ~]$ ls /lib/systemd/system/inf* -l
-rw-r--r--. 1 root root 268 Oct 17 09:54 /lib/systemd/system/influxdb.service

Influxdb 二进制文件在这里:

[vagrant@localhost ~]$ ls /usr/local/bin/inf* -l
-rwxr-xr-x. 1 influxdb influxdb 33235536 Oct 17 09:46 /usr/local/bin/influx
-rwxr-xr-x. 1 influxdb influxdb 95804192 Oct 17 09:46 /usr/local/bin/influxd

Systemd 服务状态为:

[vagrant@localhost ~]$ systemctl status influxdb.service
● influxdb.service - InfluxDB 2.0 service file.
   Loaded: loaded (/usr/lib/systemd/system/influxdb.service; enabled; vendor preset: disabled)
   Active: active (running) since Sat 2020-10-17 11:39:54 UTC; 16min ago
     Docs: https://v2.docs.influxdata.com/v2.0/get-started/
 Main PID: 13398 (influxd)
   CGroup: /system.slice/influxdb.service
           └─13398 /usr/local/bin/influxd

但是,该服务无法正常工作,查看后sudo journalctl | grep influxdb | less ,我发现了以下情况:

Oct 17 09:46:27 localhost.localdomain sudo[16616]:  vagrant : TTY=pts/0 ; PWD=/opt/influxdb-2.0.0-rc.1_linux_amd64 ; USER=root ; COMMAND=/bin/cp ./{influx, influxd} /usr/local/bin
Oct 17 09:46:37 localhost.localdomain sudo[16619]:  vagrant : TTY=pts/0 ; PWD=/opt/influxdb-2.0.0-rc.1_linux_amd64 ; USER=root ; COMMAND=/bin/cp {influx, influxd} /usr/local/bin
Oct 17 09:46:52 localhost.localdomain sudo[16634]:  vagrant : TTY=pts/0 ; PWD=/opt/influxdb-2.0.0-rc.1_linux_amd64 ; USER=root ; COMMAND=/bin/cp influx influxd /usr/local/bin
Oct 17 09:50:31 localhost.localdomain sudo[16653]:  vagrant : TTY=pts/0 ; PWD=/usr/lib/systemd/system ; USER=root ; COMMAND=/sbin/useradd -rs /bin/false influxdb
Oct 17 09:50:31 localhost.localdomain useradd[16655]: new group: name=influxdb, GID=993
Oct 17 09:50:31 localhost.localdomain useradd[16655]: new user: name=influxdb, UID=996, GID=993, home=/home/influxdb, shell=/bin/false
Oct 17 09:50:42 localhost.localdomain sudo[16661]:  vagrant : TTY=pts/0 ; PWD=/usr/lib/systemd/system ; USER=root ; COMMAND=/bin/touch /lib/systemd/system/influxdb.service
Oct 17 09:51:14 localhost.localdomain sudo[16677]:  vagrant : TTY=pts/0 ; PWD=/usr/lib/systemd/system ; USER=root ; COMMAND=/bin/vim influxdb.service
Oct 17 09:58:42 localhost.localdomain sudo[16708]:  vagrant : TTY=pts/0 ; PWD=/usr/lib/systemd/system ; USER=root ; COMMAND=/bin/systemctl start influxdb.service
Oct 17 09:58:56 localhost.localdomain influxd[16716]: ts=2020-10-17T09:58:56.784692Z lvl=error msg="Failed opening bolt" log_id=0PuVoU40000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:58:56 localhost.localdomain influxd[16716]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:58:56 localhost.localdomain influxd[16716]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:58:56 localhost.localdomain influxd[16716]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:58:56 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:58:56 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:58:56 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:58:57 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 09:59:10 localhost.localdomain influxd[16731]: ts=2020-10-17T09:59:10.994806Z lvl=error msg="Failed opening bolt" log_id=0PuVpL_W000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:59:10 localhost.localdomain influxd[16731]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:59:11 localhost.localdomain influxd[16731]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:59:11 localhost.localdomain influxd[16731]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:59:11 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:59:11 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:59:11 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:59:11 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 09:59:25 localhost.localdomain influxd[16745]: ts=2020-10-17T09:59:25.253903Z lvl=error msg="Failed opening bolt" log_id=0PuVqDHG000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:59:25 localhost.localdomain influxd[16745]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:59:25 localhost.localdomain influxd[16745]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:59:25 localhost.localdomain influxd[16745]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:59:25 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:59:25 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:59:25 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:59:25 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 09:59:39 localhost.localdomain influxd[16759]: ts=2020-10-17T09:59:39.280461Z lvl=error msg="Failed opening bolt" log_id=0PuVr440000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:59:39 localhost.localdomain influxd[16759]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:59:39 localhost.localdomain influxd[16759]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:59:39 localhost.localdomain influxd[16759]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:59:39 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:59:39 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:59:39 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:59:39 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 09:59:53 localhost.localdomain influxd[16778]: ts=2020-10-17T09:59:53.202433Z lvl=error msg="Failed opening bolt" log_id=0PuVrvSW000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:59:53 localhost.localdomain influxd[16778]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:59:53 localhost.localdomain influxd[16778]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:59:53 localhost.localdomain influxd[16778]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:59:53 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:59:53 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:59:53 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:59:53 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 10:00:07 localhost.localdomain influxd[16795]: ts=2020-10-17T10:00:07.316899Z lvl=error msg="Failed opening bolt" log_id=0PuVsma0000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 10:00:07 localhost.localdomain influxd[16795]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied

根据上面的日志,创建文件夹失败。我运行了此命令:sudo mkhomedir_helper influxdb创建主文件夹influxdb,检查权限的结果如下:

[vagrant@localhost ~]$ sudo ls -l /home
total 0
drwxr-xr-x. 4 influxdb influxdb  95 Oct 17 11:39 influxdb
drwx------. 4 vagrant  vagrant  109 Oct 17 11:54 vagrant

我无法弄清楚我缺少什么来为用户(创建:)提供足够的权限来sudo useradd -rs /bin/false influxdb将二进制文件作为服务运行?

更新:已添加审计日志

type=SERVICE_START msg=audit(1602934669.699:3137): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934683.369:3138): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934683.556:3139): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934683.556:3140): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934683.558:3141): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934697.637:3142): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934697.879:3143): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934697.879:3144): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934697.882:3145): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934711.388:3146): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934711.561:3147): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934711.561:3148): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934711.565:3149): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934725.261:3158): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934725.700:3159): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934725.700:3160): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934725.700:3161): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934739.450:3162): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934739.558:3163): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934739.559:3164): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934739.561:3165): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934753.257:3166): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934753.585:3167): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934753.585:3168): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934753.588:3169): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934783.087:3186): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934794.151:3193): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=USER_AUTH msg=audit(1602937018.434:3233): pid=13575 uid=1000 auid=1000 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=? acct="influxdb" exe="/usr/bin/su" hostname=localhost.localdomain addr=? terminal=pts/0 res=failed'
type=USER_CHAUTHTOK msg=audit(1602937096.193:3238): pid=13581 uid=0 auid=1000 ses=7 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=PAM:chauthtok grantors=? acct="influxdb" exe="/usr/bin/passwd" hostname=localhost.localdomain addr=? terminal=pts/0 res=failed'

需要帮忙?谢谢

答案1

我一直不确定这个问题,直到昨天我遇到了类似的问题并将其追溯到 SELinux。

InfluxDB 没有 SELinux 策略,Red Hat 也没有提供,InfluxDB 本身也没有。此类服务在通用策略下运行,该策略禁止服务访问,/home因为系统服务应将其文件放在其他地方。

尝试将 InfluxDB 主目录从 移动/home/influxdb/var/lib/influxdb。您可以这样做:

  1. 运行sudo mv /home/influxdb /var/lib/influxdb以移动文件。
  2. 运行sudo restorecon -rv /var/lib/influxdb以修复 SELinux 上下文。
  3. 运行sudo vipw编辑passwd文件,将influx用户的主目录从 更改/home/influxdb/var/lib/influxdb

现在尝试再次启动该服务。如果不行,您可能还需要重新运行influx setup以删除引用的任何旧配置/home

答案2

同样的问题。似乎需要具有正确权限的 /home/influxdb 文件夹。以下方法对我有用

sudo mkdir /home/influxdb
sudo chown -R influxdb:influxdb /home/influxdb

或者将 useradd 命令修改为以下内容也可能有效(我还没有尝试过)并且这将是一个更干净的修复:

sudo useradd -d /home/influxdb -rs /bin/false influxdb

相关内容