WARNING drop_privileges: setgroups(1, 0) failed: Operation not permitted #492

New issue

Closed

opened 2022-01-21 14:04:52 +00:00 by elhananjair · 5 comments

elhananjair commented 2022-01-21 14:04:52 +00:00

Copy link

What I'm trying to do and why

Actually this is not borgmatic error, I just wanted a support on using 'mail' command inside config.yaml hooks section.
this is what my config.yaml looks like:

hooks:
# List of one or more shell commands or scripts to execute
# before creating a backup, run once per configuration file.
before_backup:
- echo "Starting a backup."
- echo "Backup and Prune process is about to start" | /usr/bin/mail -s "Nextcloud backup log" mymail@gmail.com

and am getting this error:
WARNING drop_privileges: setgroups(1, 0) failed: Operation not permitted

I could execute this command from random .sh script file but inside borgmatic it is showing this the above error. I apperciate someone help me with this. Thank you.

Steps to reproduce (if a bug)

Include (sanitized) borgmatic configuration files if applicable.

Actual behavior (if a bug)

Include (sanitized) --verbosity 2 output if applicable.

Expected behavior (if a bug)

Other notes / implementation ideas

Environment

borgmatic version: [version here]

Use sudo borgmatic --version or sudo pip show borgmatic | grep ^Version

borgmatic installation method: [e.g., Debian package, Docker container, etc.]

Borg version: [version here]

Use sudo borg --version

Python version: [version here]

Use python3 --version

Database version (if applicable): [version here]

Use psql --version or mysql --version on client and server.

operating system and version: [OS here]

#### What I'm trying to do and why Actually this is not borgmatic error, I just wanted a support on using 'mail' command inside config.yaml hooks section. this is what my config.yaml looks like: > hooks: # List of one or more shell commands or scripts to execute # before creating a backup, run once per configuration file. before_backup: - echo "Starting a backup." - echo "Backup and Prune process is about to start" | /usr/bin/mail -s "Nextcloud backup log" mymail@gmail.com and am getting this error: **WARNING drop_privileges: setgroups(1, 0) failed: Operation not permitted** I could execute this command from random .sh script file but inside borgmatic it is showing this the above error. I apperciate someone help me with this. Thank you. #### Steps to reproduce (if a bug) Include (sanitized) borgmatic configuration files if applicable. #### Actual behavior (if a bug) Include (sanitized) `--verbosity 2` output if applicable. #### Expected behavior (if a bug) #### Other notes / implementation ideas #### Environment **borgmatic version:** [version here] Use `sudo borgmatic --version` or `sudo pip show borgmatic | grep ^Version` **borgmatic installation method:** [e.g., Debian package, Docker container, etc.] **Borg version:** [version here] Use `sudo borg --version` **Python version:** [version here] Use `python3 --version` **Database version (if applicable):** [version here] Use `psql --version` or `mysql --version` on client and server. **operating system and version:** [OS here]

witten added the

question / support

label 2022-01-21 18:44:37 +00:00

witten commented 2022-01-21 18:47:54 +00:00

Owner

Copy link

Where are you seeing the error? And how are you running borgmatic when it occurs? If you're using systemd, I'm guessing that your systemd configuration has locked down permissions such that the borgmatic process can't run the mail hook. Could I get a look at your systemd borgmatic service configuration? Thanks.

Where are you seeing the error? And how are you running borgmatic when it occurs? If you're using systemd, I'm guessing that your systemd configuration has locked down permissions such that the borgmatic process can't run the `mail` hook. Could I get a look at your systemd borgmatic service configuration? Thanks.

elhananjair commented 2022-01-24 07:01:55 +00:00

Author

Copy link

I checked the error from journactl output of borgmatic.serviec. Am running borgmatic using systemd and I barely changed example config of borgmatic.service.

https://paste.centos.org/view/9083c5d4 this my borgmatic.service file.

I checked the error from journactl output of borgmatic.serviec. Am running borgmatic using systemd and I barely changed example config of borgmatic.service. https://paste.centos.org/view/9083c5d4 this my borgmatic.service file.

witten commented 2022-01-24 18:01:24 +00:00

Owner

Copy link

My guess here based on the error message is that ProtectControlGroups=yes is interfering. So you could try commenting that out and reloading the systemd service (sudo systemctl daemon-reload and sudo systemctl restart borgmatic). If that doesn't solve it, you could try commenting out the system service security options (everything from LockPersonality to CapabilityBoundingSet, inclusive) to see if any of those are causing your particular issue.

My *guess* here based on the error message is that `ProtectControlGroups=yes` is interfering. So you could try commenting that out and reloading the systemd service (`sudo systemctl daemon-reload` and `sudo systemctl restart borgmatic`). If that doesn't solve it, you could try commenting out the system service security options (everything from `LockPersonality` to `CapabilityBoundingSet`, inclusive) to see if any of those are causing your particular issue.

👍 1

elhananjair commented 2022-01-25 11:50:27 +00:00

Author

Copy link

My guess here based on the error message is that ProtectControlGroups=yes is interfering. So you could try commenting that out and reloading the systemd service (sudo systemctl daemon-reload and sudo systemctl restart borgmatic). If that doesn't solve it, you could try commenting out the system service security options (everything from LockPersonality to CapabilityBoundingSet, inclusive) to see if any of those are causing your particular issue.

Thank you so much it worked for me when I commented out CapabilityBoundingSet property. I think it eases up the security to run other commands.

> My *guess* here based on the error message is that `ProtectControlGroups=yes` is interfering. So you could try commenting that out and reloading the systemd service (`sudo systemctl daemon-reload` and `sudo systemctl restart borgmatic`). If that doesn't solve it, you could try commenting out the system service security options (everything from `LockPersonality` to `CapabilityBoundingSet`, inclusive) to see if any of those are causing your particular issue. Thank you so much it worked for me when I commented out CapabilityBoundingSet property. I think it eases up the security to run other commands.

elhananjair closed this issue 2022-01-25 11:50:27 +00:00

witten referenced this issue from a commit 2022-01-25 17:27:12 +00:00

Add comment about systemd service setting that may interfere with external commands in hooks (#492).

witten commented 2022-01-25 17:27:27 +00:00

Owner

Copy link

Glad to hear it's working for you now! I'll add a comment in the sample systemd service file about this.

Glad to hear it's working for you now! I'll add a comment in the sample systemd service file about this.

❤️ 1

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

mongodb-password-transport

parallel-borgmatic

command-hook-steps

2.1.7

2.1.6

2.1.5

2.1.4

2.1.3

2.1.2

2.1.1

2.1.0

2.0.13

2.0.12

2.0.11

2.0.10

2.0.9

2.0.8

2.0.7

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

1.9.14

1.9.13

1.9.12

1.9.11

1.9.10

1.9.9

1.9.8

1.9.7

1.9.6

1.9.5

1.9.4

1.9.3

1.9.2

1.9.1

1.9.0

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.15

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

1.7.7

1.7.6

1.7.5

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

1.6.6

1.6.5

1.6.4

1.6.3

1.6.2

1.6.1

1.6.0

1.5.24

1.5.23

1.5.22

1.5.21

1.5.20

1.5.19

1.5.18

1.5.17

1.5.16

1.5.15

1.5.14

1.5.13

1.5.12

1.5.11

1.5.10

1.5.9

1.5.8

1.5.7

1.5.7.dev0

1.5.6

1.5.5

1.5.4

1.5.3

1.5.2

1.5.1

1.5.0

1.4.22

1.4.21

1.4.20

1.4.19

1.4.18

1.4.17

1.4.16

1.4.15

1.4.14

1.4.13

1.4.12

1.4.11

1.4.10

1.4.9

1.4.8

1.4.7

1.4.6

1.4.5

1.4.4

1.4.3

1.4.2

1.4.1

1.4.0

1.3.26

1.3.25

1.3.24

1.3.23

1.3.22

1.3.21

1.3.20

1.3.19

1.3.18

1.3.17

1.3.16

1.3.15

1.3.14

1.3.13

1.3.12

1.3.11

1.3.10

1.3.9

1.3.8

1.3.7

1.3.6

1.3.5

1.3.4

1.3.3

1.3.2

1.3.1

1.3.0

1.2.18

1.2.17

1.2.16

1.2.15

1.2.14

1.2.13

1.2.12

1.2.11

1.2.10

1.2.9

1.2.8

1.2.7

1.2.6

1.2.5

1.2.4

1.2.3

1.2.2

1.2.1

1.2.0

1.1.15

1.1.14

1.1.13

1.1.12

1.1.11

1.1.10

1.1.9

1.1.7

1.1.6

1.1.5

1.1.4

1.1.3

1.1.2

1.1.1

1.1.0

1.0.3

1.0.2

1.0.1

1.0.0

0.1.8

0.1.7

0.1.6

0.1.5

0.1.4

0.1.3

0.1.2

0.1.1

0.1.0

0.0.7

0.0.6

0.0.5

0.0.4

0.0.3

0.0.2

Labels

Clear labels   

blocked

  

breaking

  

bug

  

data loss

  

design finalized

  

good first issue

  

new feature area

  

question / support

  

security

  

waiting for response

No labels

blocked

breaking

bug

data loss

design finalized

good first issue

new feature area

question / support

security

waiting for response

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

borgmatic-collective/borgmatic#492

No description provided.