Fix Permission denied: '/var/lib/ckan/storage/uploads/group'
- Dominant language
- Shell
- Stars
- 35
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
## Expected Behavior
After editing the organization and click `create`, the organization is correctly persisted.
## Current Behavior
After editing the organization, when `create` is clicked, 500 is thrown, and the following log is printed:
```
gdi-userportal-ckan-deployment-ckan-1 | 2023-12-27 20:11:46,577 INFO [ckan.config.middleware.flask_app] 200 /api/i18n/en render time 0.010 seconds
gdi-userportal-ckan-deployment-ckan-1 | 2023-12-27 20:12:11,074 ERROR [ckan.config.middleware.flask_app] [Errno 13] Permission denied: '/var/lib/ckan/storage/uploads/group'
gdi-userportal-ckan-deployment-ckan-1 | Traceback (most recent call last):
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/site-packages/flask/app.py", line 1516, in full_dispatch_request
gdi-userportal-ckan-deployment-ckan-1 | rv = self.dispatch_request()
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/site-packages/flask/app.py", line 1502, in dispatch_request
gdi-userportal-ckan-deployment-ckan-1 | return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args)
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/site-packages/flask/views.py", line 84, in view
gdi-userportal-ckan-deployment-ckan-1 | return current_app.ensure_sync(self.dispatch_request)(*args, **kwargs)
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/site-packages/flask/views.py", line 158, in dispatch_request
gdi-userportal-ckan-deployment-ckan-1 | return current_app.ensure_sync(meth)(*args, **kwargs)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/config/middleware/../../views/group.py", line 862, in post
gdi-userportal-ckan-deployment-ckan-1 | group = _action(u'group_create')(context, data_dict)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/logic/__init__.py", line 580, in wrapped
gdi-userportal-ckan-deployment-ckan-1 | result = _action(context, data_dict, **kw)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/logic/action/create.py", line 946, in organization_create
gdi-userportal-ckan-deployment-ckan-1 | return _group_or_org_create(context, data_dict, is_org=True)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/logic/action/create.py", line 739, in _group_or_org_create
gdi-userportal-ckan-deployment-ckan-1 | upload = uploader.get_uploader('group')
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/lib/uploader.py", line 61, in get_uploader
gdi-userportal-ckan-deployment-ckan-1 | upload = Upload(upload_to, old_filename)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/lib/uploader.py", line 129, in __init__
gdi-userportal-ckan-deployment-ckan-1 | os.makedirs(self.storage_path)
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/os.py", line 225, in makedirs
gdi-userportal-ckan-deployment-ckan-1 | mkdir(name, mode)
gdi-userportal-ckan-deployment-ckan-1 | PermissionError: [Errno 13] Permission denied: '/var/lib/ckan/storage/uploads/group'
gdi-userportal-ckan-deployment-ckan-1 | 2023-12-27 20:12:11,111 INFO [ckan.config.middleware.flask_app] 500 /organization/new render time 0.061 seconds
```
## Possible Solution
The folder `/var/lib/ckan/storage/uploads/group` does not exist when the exception happens. So I tested two things:
- `mkdir /var/lib/ckan/storage/uploads/group`
- `chmod u+rwx /var/lib/ckan`
I believe there is some inconsistence with user permissions. The second command seems more reasonable to me, but I am not aware of other possible implications, that is why I oppened this bug.
## Steps to Reproduce
1. Build a custom CKAN docker image (e.g. https://github.com/GenomicDataInfrastructure/gdi-userportal-ckan-docker).
2. Run docker image using docker compose v2 (e.g. https://github.com/GenomicDataInfrastructure/gdi-userportal-ckan-deployment).
3. Add organization
4. Click `create`
## Context (Environment)
OS: `Darwin 23.2.0 Darwin Kernel Version 23.2.0: Wed Nov 15 21:55:06 PST 2023; root:xnu-10002.61.3~2/RELEASE_ARM64_T6020 arm64`
Docker: `Docker version 24.0.6, build ed223bc820`
Colima: `colima version 0.5.5`
## Detailed Description
On line 94, the user `ckan` is set as owner of the folder `${CKAN_STORAGE_PATH}`. On top of it, we could ensure the owner has rights to read, write and execute files.
## Possible Implementation
Replace line 93 and 94 from ckan-base [Dockerfile](
https://github.com/ckan/ckan-docker-base/blob/cbd8878de7a234d4187fd8669b40f4bce80f6692/ckan-2.10/base/Dockerfile#L93C1-L94C44) by the following command?
```
RUN mkdir -p ${CKAN_STORAGE_PATH} && \
chown -R ckan:ckan ${CKAN_STORAGE_PATH} && \
chmod u+rwx ${CKAN_STORAGE_PATH}
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with lines 93–94 of the ckan-base Dockerfile linked in the issue and review how ${CKAN_STORAGE_PATH} is created and owned. Reproduce with the listed Docker Compose steps, then verify that creating an organization does not return a 500 and that the CKAN user can create the uploads/group directory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100