I am in a docker container, with an NFS volume mapped. In a directory inside the volume, I can create files by touch
or other methods, but not using mktemp
:
$ ls -ld /home/share/scripts/converth264queue/
drwxrwxr-x 1 abc abc 964 Oct 22 08:04 /home/share/scripts/converth264queue/
$ touch /home/share/scripts/converth264queue/test2
$ ls -l /home/share/scripts/converth264queue/test2
-rw-r--r-- 1 abc abc 10 Oct 22 08:04 /home/share/scripts/converth264queue/test2
$ cat > /home/share/scripts/converth264queue/test3
test
etst
$ mktemp -p /home/share/scripts/converth264queue file.XXXXXXXX
mktemp: failed to create file via template ‘/home/share/scripts/converth264queue/file.XXXXXXXX’: Permission denied
$ mktemp -p /home/share/scripts/converth264queue
mktemp: failed to create file via template ‘/home/share/scripts/converth264queue/tmp.XXXXXXXXXX’: Permission denied
$ id
uid=1000(abc) gid=100(abc) groups=100(abc),1000(users)
$ ls -lnd /home/share/scripts/converth264queue/
drwxrwxr-x 1 1000 100 964 Oct 22 08:04 /home/share/scripts/converth264queue/
Any ideas why this would occur?
Note, mktemp in the docker is provided by coreutils so no setuid:
$ ls -ld $(which mktemp)
lrwxrwxrwx 1 root root 20 Oct 20 09:09 /bin/mktemp -> ../usr/bin/coreutils
$ ls -ld /usr/bin/coreutils
-rwxr-xr-x 1 root root 1065928 May 1 21:44 /usr/bin/coreutils
touch /home/share/scripts/converth264queue/test
,cat > /home/share/scripts/converth264queue/test2
, and evenls -ld /home/share/scripts/converth264queue
. (2) It probably won’t really help in this case, but, as a general rule, when a command fails unexpectedly / mysteriously, it’s a good idea toecho $?
to see whether that tells you anything or gives you a clue. (3) Does this problem occur only in/home/share/scripts/converth264queue
? … (Cont’d)/tmp
, for example) makes the question hard to read (requires horizontal scrolling) and makes commenting awkward. (4) Is there any possibility thatmktemp
is setuid on your system? Dols -ld $(which mktemp)
. (5a)ls
ignores-a
when you specify-d
(i.e.,ls -lad
is equivalent tols -ld
). (5b)ls -n
implies-l
(i.e.,ls
ignores-l
when you specify-n
).1
. I am wondering if there is something in the collision free guarantee that mktemp provides that means it needs greater access than can be provided across a docker mapped nfs volume.