Accessdenied expcetion on snapshot directory

[Arp]

Hi,

I am trying to set up a snapshot directory.
I created /home/user/elastic and put this into the configuration file:
path.repo: "/home/user/elastic"

If I then restart, I get the error. I googled a lot around and I always found two possibilities. Change the owner or the attribute.
So I tried changing the owner to elasticsearch, user, root and also tried 777 as an attribute for the directory. I still get the error message when I want to restart the service.

Any advice please?
Thanks.

[spinscale (Alexander Reelsen)]

please share more information, like the user running elasticsearch as (maybe from a ps output), if that repo is an NFS share or not, and if you have configured that directory on all your hosts.

Also, share the full logfile output please.

Thanks!

[Arp]

Hi,

It is a fresh installation of Elasticsearch 7.6.1 on Red Hat 8.
I did not do anython with Elasticsearch, just installed and checked if it is working.
Next I added

path.repo: ["/home/user/elastic/snapshot"]

to the elasticsearch.yml file.

If I try to restart the service (service elasticsearch restart)
I get

[2020-03-18T17:30:44,434][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [pc] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: Unable to access 'path.repo' (/home/user/elastic/snapshot)
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:174) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) ~[elasticsearch-cli-7.6.1.jar:7.6.1]
at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.6.1.jar:7.6.1]
Caused by: java.lang.IllegalStateException: Unable to access 'path.repo' (/home/user/elastic/snapshot)
at org.elasticsearch.bootstrap.FilePermissionUtils.addDirectoryPath(FilePermissionUtils.java:70) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Security.addFilePermissions(Security.java:313) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Security.createPermissions(Security.java:252) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Security.configure(Security.java:121) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:216) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.6.1.jar:7.6.1]
... 6 more
Caused by: java.nio.file.AccessDeniedException: /home/user/elastic
at sun.nio.fs.UnixException.translateToIOException(UnixException.java:90) ~[?:?]
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111) ~[?:?]
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:116) ~[?:?]
at sun.nio.fs.UnixFileSystemProvider.checkAccess(UnixFileSystemProvider.java:313) ~[?:?]
at java.nio.file.Files.createDirectories(Files.java:765) ~[?:?]
at org.elasticsearch.bootstrap.Security.ensureDirectoryExists(Security.java:389) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.FilePermissionUtils.addDirectoryPath(FilePermissionUtils.java:68) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Security.addFilePermissions(Security.java:313) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Security.createPermissions(Security.java:252) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Security.configure(Security.java:121) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:216) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.6.1.jar:7.6.1]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.6.1.jar:7.6.1]
... 6 more

[spinscale (Alexander Reelsen)]

Can you share the permissions from /home/, /home/user and /home/user/elastic? Thanks.

[Arp]

/home/: drwxr-xr-x. 3 root root
/home/user/: drwx------. 17 user user
/home/user/elastic: drwxrwxr-x 3 elasticsearch elasticsearch

Why would it matter what the permissions outside the /home/user/elastic folder are?

[spinscale (Alexander Reelsen)]

change the /home/user permissions to make it accessible for the elasticsearch user/group.

Sample (works under osx):

cd /tmp
mkdir -p foo/bar/baz
sudo chown root foo/bar
sudo chmod 700 foo/bar
cd foo/bar/baz
cd: permission denied: foo/bar/baz

same problem here...

[Arp]

for convenience I made a chmod 777 on /home/user, and that appears to work. But why the user directory, if I want it to be in /home/user/elastic/snapshot/ ?

[spinscale (Alexander Reelsen)]

This is how posix permissions work. Directories can only be traversed with the executable permission set for the reader.

There are more details to it like privileged processes changing into such a dir and then dropping privileges or using hardlinks, but the above matches for behaviour in Elasticsearch.

[Arp]

Ok ... Thanks!