2

I am in a docker container, with an NFS volume mapped. In a directory inside the volume, I can create files by touch or other methods, but not using mktemp:

$ ls -ld /home/share/scripts/converth264queue/
drwxrwxr-x 1 abc abc 964 Oct 22 08:04 /home/share/scripts/converth264queue/
$ touch /home/share/scripts/converth264queue/test2
$ ls -l /home/share/scripts/converth264queue/test2
-rw-r--r-- 1 abc abc 10 Oct 22 08:04 /home/share/scripts/converth264queue/test2
$ cat > /home/share/scripts/converth264queue/test3
test
etst

$ mktemp -p /home/share/scripts/converth264queue file.XXXXXXXX
mktemp: failed to create file via template ‘/home/share/scripts/converth264queue/file.XXXXXXXX’: Permission denied
$ mktemp -p /home/share/scripts/converth264queue
mktemp: failed to create file via template ‘/home/share/scripts/converth264queue/tmp.XXXXXXXXXX’: Permission denied
$ id
uid=1000(abc) gid=100(abc) groups=100(abc),1000(users)
$ ls -lnd /home/share/scripts/converth264queue/
drwxrwxr-x 1 1000 100 964 Oct 22 08:04 /home/share/scripts/converth264queue/

Any ideas why this would occur?

Note, mktemp in the docker is provided by coreutils so no setuid:

$ ls -ld $(which mktemp)
lrwxrwxrwx 1 root root 20 Oct 20 09:09 /bin/mktemp -> ../usr/bin/coreutils
$ ls -ld /usr/bin/coreutils
-rwxr-xr-x 1 root root 1065928 May  1 21:44 /usr/bin/coreutils
3
  • (1) I would get a better feeling about your question if you would demonstrate that some commands work with a full pathname; e.g., touch /home/share/scripts/converth264queue/test, cat > /home/share/scripts/converth264queue/test2, and even ls -ld /home/share/scripts/converth264queue.  (2) It probably won’t really help in this case, but, as a general rule, when a command fails unexpectedly / mysteriously, it’s a good idea to echo $? to see whether that tells you anything or gives you a clue.  (3) Does this problem occur only in /home/share/scripts/converth264queue?  … (Cont’d) Oct 21, 2018 at 15:56
  • (Cont’d) …  What experimentation have you done?  Where does it occur and not occur?  The fact that you have demonstrated it in a directory whose name is 36 characters long (nine times as long as /tmp, for example) makes the question hard to read (requires horizontal scrolling) and makes commenting awkward.  (4) Is there any possibility that mktemp is setuid on your system?  Do ls -ld $(which mktemp).  (5a) ls ignores -a when you specify -d (i.e., ls -lad is equivalent to ls -ld).  (5b) ls -n implies -l (i.e., ls ignores -l when you specify -n). Oct 21, 2018 at 15:56
  • Yeah the error code is just 1. I am wondering if there is something in the collision free guarantee that mktemp provides that means it needs greater access than can be provided across a docker mapped nfs volume.
    – Paul
    Oct 21, 2018 at 21:13

0

You must log in to answer this question.

Browse other questions tagged .