Ghost-CLI failing on: Checking folder permissions

[snarlynarwhal]

This issue is a bug report.

Summary

While following the Install & Setup (production) tutorial, the installation fails at: Checking folder permissions

Steps to Reproduce (for a bug report)

Follow the instructions for the Install & Setup (production) tutorial.

I follow the steps in the Installing on Linux tutorial and fail at ghost install, ghost setup, and ghost doctor at the exact same point: when Checking folder permissions. I receive a very uninformative (maybe give details about which user needs what access to where) message that states:

One or more errors occurred.

1) Checking folder permissions

Then it proceeds to list out each and every file/folder inside of the following folders:

• content
• versions
• system

Here's my ls -al output just to verify everything has the right permissions (at least based on the tutorial):

snarlynarwhal@halfhuman:/var/www/dwerve.com/html/ghost$ ls -al
total 28
drwxrwsr-x 5 snarlynarwhal snarlynarwhal 4096 May 17 22:20 .
drwxrwsr-x 3 www           www           4096 May 17 22:17 ..
-rw-rw-r-- 1 snarlynarwhal snarlynarwhal  517 May 17 22:20 config.production.json
drwxrwsr-x 8 ghost         ghost         4096 May 17 22:18 content
lrwxrwxrwx 1 snarlynarwhal snarlynarwhal   46 May 17 22:18 current -> /var/www/dwerve.com/html/ghost/versions/1.22.8
-rw-rw-r-- 1 snarlynarwhal snarlynarwhal   88 May 17 22:19 .ghost-cli
drwxrwsr-x 3 snarlynarwhal snarlynarwhal 4096 May 17 22:20 system
drwxrwsr-x 3 snarlynarwhal snarlynarwhal 4096 May 17 22:18 versions
snarlynarwhal@halfhuman:/var/www/dwerve.com/html/ghost$

Log file (for a bug report)

✔ Checking system Node.js version
✔ Checking logged in user
✔ Ensuring user is not logged in as ghost user
✔ Checking if logged in user is directory owner
✔ Checking current folder permissions
✔ Checking operating system compatibility
✔ Checking for a MySQL installation
Running sudo command: systemctl is-active ghost_blog-dwerve-com
✔ Validating config
✖ Checking folder permissions
✔ Checking file permissions
✔ Checking content folder ownership
✔ Checking memory availability
One or more errors occurred.

1) Checking folder permissions

Message: Your installation folder contains some directories or files with incorrect permissions:
- ./
- ./content
- ./content/images
- ./content/data
...
- ./versions/1.22.8/content/settings
- ./system
- ./system/files
Run sudo find ./ -type d -exec chmod 775 {} \; and try again.

Debug Information:
    OS: Ubuntu, v16.04
    Node Version: v6.14.2
    Ghost-CLI Version: 1.7.3
    Environment: production
    Command: 'ghost update'

Try running ghost doctor to check your system for known issues.

Please refer to https://docs.ghost.org/v1/docs/troubleshooting#section-cli-errors for troubleshooting.

Technical details (for a bug report)

The exact recommended stack.

Bug submission checklist

Please fill out this checklist to acknowledge that you followed the requirements to submit a bug report.

• Tried to find help in the forum & docs
• Checked for existing issues
• Attached log file
• Provided technical details incl. operating system

[aileen]

Hey @snarlynarwhal 👋

I receive a very uninformative (maybe give details about which user needs what access to where) message that states

I'm not sure I understand, the output tells you to run a command:

Run sudo find ./ -type d -exec chmod 775 {} ; and try again.

When you created the installation folder, after setting the ownership to your user, did you also run the command to change the permissions?

sudo chmod 775 /var/www/dwerve.com/html/ghost

I am closing this as I don't believe this is a bug in the CLI. Please come over to our forum if you need help. If it turns out to be a bug indeed, we can always reopen this issue.

[snarlynarwhal]

I ran the command it prompted me too and sudo chmod 775 /var/www/dwerve.com/html/ghost (take a look at my ls -al output above).

More info: So I started from scratch (wayyyy too many times) and found that it installs just fine. ghost run works fine too - I can see the blog in my browser. Only ghost start fails. So at the end of the installation when it prompts me to start ghost, I select yes.. then it fails.

[snarlynarwhal]

So I discovered the issue arose from special permission modes: setuid, setgid, and sticky bit. I removed them using sudo chmod 000775 on the relevant folders. I set these permission modes on my var/www folder for another reason and creating a new folder in this directory seemed to carry these settings over to the new folder. Maybe the check can consider these and propose a command to fix this so future users do not get stuck like I did?

[acburdine]

@snarlynarwhal that's interesting - didn't know about special permissions modes. Feel free to propose a fix if you find one that works - either a fix in how we check directory permissions or a fix that just adds 000 to the bits of the suggested command 😄

[snarlynarwhal]

I submitted a document proposal to include the command to remove directory flags as a step in the installation process - hopefully that helps prevent other users from overlooking the Knowledge Base section as I did!

[ErisDS]

Sorry to wade in - I rejected the docs change not because I think the point is invalid, but because I don't think adding yet another step to our already complex install is the right solution, especially given that this is not a common case.

What I think we should do:

1. Ghost-CLI should detect and handle these permissions properly, they are part of the standard linux permission system even though they are less frequently used and commonly understood.
2. If we do need docs short term, it should be troubleshooting/faq rather than an upfront step.

@snarlynarwhal the existing checks live here: https://github.com/TryGhost/Ghost-CLI/blob/master/lib/commands/doctor/checks/check-permissions.js#L14. Advice or a PR to adjust this would be greatly appreciated.

[snarlynarwhal]

Oh derp, @acburdine already proposed a better solution (read his comment before coffee.. didn't process haha): instead of adding the additional command, pretty sure chmod 000775 can handle both changing the permissions and unsetting the directory flags in a single step. I believe the 000 prefix does the exact same thing as chmod g-s. So the installation step and cli output can include that 000 prefix? @ErisDS, does that sound like a more appropriate fix?

[vikaspotluri123]

I believe the 000 prefix does the exact same thing as chmod g-s

If that's the case, then merging the prefix into the command should be fine - the fix that was discussed was kind of convoluted because I wasn't aware of the 000 prefix. We decided against it because the complexity outweighed the benefit, but since this is much more simple and straightforward there is minimal added complexity.

If you don't want / are unable to create a fix pr, let me know as I will create one on your behalf 😄

[snarlynarwhal]

Okay cool 👍 I can go ahead and create a pr later today

[vikaspotluri123]

I had an essay written about chmod and how it works, but Wikipedia + chmod manual ended up sumarizing it into a single sentence 😬 For future reference, in Linux, "To clear these [sticky] bits for directories with a numeric mode requires an additional leading zero, or leading = like 00755 , or =755"

[radonthetyrant]

I'm having the same issue, but I don't care that some content directories aren't the "right" permissions. Can I ignore that with a flag or something so it doesn't prevent me from starting the script?

[vikaspotluri123]

Not at the moment, adding support to disable these checks is something planned for the future as part of #47

[acburdine]

@radonthetyrant the reason those checks are there is because without the correct file permissions, you may have issues getting Ghost to run properly. There has been some thought into adding skip flags for certain checks, but the intention behind these checks was to make sure that Ghost has the optimal environment to run in, and so that users (esp. non-technical ones) would be helped to fix their own installations without needing to contact support every time 😉

[radonthetyrant]

@acburdine yes, I understood its purpose. I still have trouble wrapping my head around how it seems to be enforced, when I can have valid reasons to not want to chown hundred times between two users just to make edits. It seems tedious and, for users that are more advanced and can work out any permission-related issues, restrictive.
It should be a warning at worst. @vikaspotluri123 's post seems to have cleared it up, I'm looking forward at seeing the skip implemented!
thanks