nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

iwui permission issue.

phanee

I am running a workflow in TS 6.7.1 SP1 SOLARIS 10 using a wft file.

I have a CGI task which writes a log inside a folder.
Problem is since CGI tasks run as iwui user it doest have permission to write logs insides the log folder.

file permission owner group
log folder - 0775 - root - iwglobal
log file - 0775 - iwui - nobody

even if I try adding iwui to iwglobal group ,the CGI task running as iwui is not able to write logs inside the log folder.

But if I change the group of the log folder to nobody, CGI task running as iwui is able to write logs.

Please advise whether this is a normal behavior (iwui cannot belong to other groups) or whether I am wrong somewhere.

Find more posts tagged with

Comments

Adam Stoller

I am running a workflow in TS 6.7.1 SP1 SOLARIS 10 using a wft file.

I have a CGI task which writes a log inside a folder.
Problem is since CGI tasks run as iwui user it doest have permission to write logs insides the log folder.

file permission owner group
log folder - 0775 - root - iwglobal
log file - 0775 - iwui - nobody

even if I try adding iwui to iwglobal group ,the CGI task running as iwui is not able to write logs inside the log folder.

But if I change the group of the log folder to nobody, CGI task running as iwui is able to write logs.

Please advise whether this is a normal behavior (iwui cannot belong to other groups) or whether I am wrong somewhere.

Where is this log folder located? If it's on the local disk (as opposed to within a branch somewhere) it seems strange that it would have a group-ownership of iwglobal. If it's in a branch somewhere - you need to figure out what TS Group it evaluates to, and then add "iwui" to that group (or run the CGI through iw_cgiwrapper.cgi and make sure all the TS users are members of that group)

Alternatively (though Security folks don't like this) you could make the log directory world-writable (chmod 777) and not have to worry about it at all.

phanee

Hi ghoti thanks, for the comments,
the log folder is on the local disk and not inside the branch.
iwglobal group is not the problem since I had changed the log folder's group permission to some other group and added iwui to that group still no effect iwui is not able to write a file inside the log folder.

Setting log directory world-writable (chmod 777) is not an option in my case due to security policy restrictions.

Another problem is iwui is not able to change the group of a file to which he is a owner of to some other group.
The only permission related operation is a able to perform is 'chmod' alone.

iwui behaves differently from other users.

Adam Stoller

Hi ghoti thanks, for the comments,
the log folder is on the local disk and not inside the branch.
iwglobal group is not the problem since I had changed the log folder's group permission to some other group and added iwui to that group still no effect iwui is not able to write a file inside the log folder.

Setting log directory world-writable (chmod 777) is not an option in my case due to security policy restrictions.

Another problem is iwui is not able to change the group of a file to which he is a owner of to some other group.
The only permission related operation is a able to perform is 'chmod' alone.

iwui behaves differently from other users.

Is the directory at least set with 775 mode bits? What about the files inside the directory? Are they at least 664 - with the right group ownership?
If you figure out the proper group ownership for what you want the directory and files to have - you might also do a chmod g+s on the directory itself so that the group ownership is preserved regardless of what process creates or updates a file within it - however you also have to be careful not to break anything...

phanee

yes gothi the log folder has 775 permission.
as specified in my earlier post

log folder has 775 permission
owner is root
group is iwglobal.

log file has 775 permission,
owner is iwui
group is nobody.

iwui's primary group is nobody,
secondary group is iwglobal.

for some reasons iwui's presence in iwglobal group is ignored.
apart from that as iwui i cannot `chgrp` or `chown`.

temporarily I have solved my issue by setting the log folder's owner as iwui.

CRB

i have the same problem, the only way for me to get this working is to write to folder with 777. i even had to move my cgi program outside iw-home because of permission issues. it is a solution in dev enviroment, but they wont like it in production. i was wondering if i can change the owner of the task from iwui to some special user who has access in system level... i will post again if i find more reasonable approche.