permissions on /var mysteriously changed to 0644

[RedScourge]

Version: Ubuntu Server 8.04 LTS

I received the following email this morning from a daily cron script:

Subject: Cron <root@db> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )

/etc/cron.daily/man-db:
find: /var/cache: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied
fopen: Permission denied

I looked up the error and I had none of the common symptoms, /tmp and /var/cache/man permissions were proper

I found the problem was /var had been changed from chmod 0755 to chmod 0644, and the man user that the script runs as could no longer access its home dir (/var/cache/man), and thus could not operate.

I just did the following and it worked again:

chmod 755 /var

This only started this morning, and the only packages I installed yesterday were the following:

libdb4.5 4.5.20-11
libgeoip1 1.4.4.dfsg-1
webalizer 2.01.10-32.1

I am not certain what caused the change of /var folder permissions but I assume it must have been one of those packages, because this error never showed up before they were installed.

I am willing to provide virtually any command output you'd like to see, just ask.

[Colin Watson (cjwatson)]

I don't know what caused the change of permissions. man-db is just the victim here, though - it's not surprising that it would break (along with lots of other stuff) with a 0644 /var. Reassigning to just "Ubuntu" since I have no idea what might be involved here ...

[RedScourge (redscourge)]

For what it's worth, I can't think of any need to ever change permissions on /var and I certainly would not do it. I will provide any info you require.

New hardware, new install, all I've done is add a bunch of packages suitable for a webserver (apache, php, mysql, related packages, etc, and some admin/log stuff like webalizer).

It must be a direct result of something that happened on Dec 10 2009 because there were no errors for anything in cron.daily the day before. I suspect the packages I mentioned because the only interesting entries in my LogWatch for this period were the following:

--------------------- dpkg status changes Begin ------------------------

 Installed:
    libdb4.5 4.5.20-11
    libgeoip1 1.4.4.dfsg-1
    webalizer 2.01.10-32.1

 Unknown lines:
    2009-12-10 10:54:20 startup archives unpack
    2009-12-10 10:54:23 configure libdb4.5 4.5.20-11 4.5.20-11
    2009-12-10 10:54:23 configure libgeoip1 1.4.4.dfsg-1 1.4.4.dfsg-1
    2009-12-10 10:54:23 configure webalizer 2.01.10-32.1 2.01.10-32.1
    2009-12-10 10:54:23 startup packages configure
    2009-12-10 10:54:23 trigproc libc6 2.7-10ubuntu5 2.7-10ubuntu5

The only other thing I can think of (and that my bash history verifies) is that I changed the default apache2 user to apache instead of www-data, with useradd/mod/del+groupadd, and that user's home is /var/www.

[Fabio Marconi (fabiomarconi)]

Hello
Is this problem present with the latest updated Karmic's, Lucid's or Maverick's packages?
Thanks in advance
Fabio

[RedScourge (redscourge)]

I don't really know what triggered it so reproducing it may take time, or may never even happen. I am going to try doing another fresh install of Lucid in the next 30 days and if it happens again on that install, I will definitely report it here.

[Fabio Marconi (fabiomarconi)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Thanks again!