[BUG] local.php file permissions incorrect

[nopoz]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Getting the error when loading up a default instance of cops using 3.1.2-ls223 (latest as of writing)

Error loading local.php
Failed opening required '/app/www/public/config/local.php' (include_path='.:/usr/share/php83') in /app/www/public/config/config.php line 15

Checking the file permissions on /app/www/public/config/local.php it's owned by root and the permissions are rwx for root user only. Since the app runs with the user and group abc, the file cannot be read:

~#/docker exec -t -i cops /bin/bash
root@d790c89eb80f:/# cd /app/www/public/config
root@d790c89eb80f:/app/www/public/config# ls -la
total 48
drwxrwxr-x 1 root root   150 Sep 10 15:28 .
drwxr-xr-x 1 root root  1128 Sep  9 10:36 ..
-rw-rw-r-- 1 root root    22 Sep  9 05:11 .gitignore
-rw-rw-r-- 1 root root  1857 Sep  9 05:11 config.php
-rw-rw-r-- 1 root root 21928 Sep  9 05:11 default.php
-rw-rw-r-- 1 root root  2445 Sep  9 05:11 loader.php
-rwx------ 1 root root  3993 Sep 10 15:28 local.php
-rw-rw-r-- 1 root root  2476 Sep  9 05:11 local.php.example
-rw-rw-r-- 1 root root   679 Sep  9 05:11 test.php

Changing the permissions to match the other files in the directory with chmod 664 local.php, the error goes away and cops loads as expected in the browser.

Compose file used:

services:
    cops:
        container_name: cops
        environment:
            - PUID=666
            - PGID=1337
            - TZ=America/Los_Angeles
        ports:
            - '127.0.0.1:5230:80'
        volumes:
            - '/docker/cops:/config'
            - '/ebooks:/books'
        restart: unless-stopped
        image: lscr.io/linuxserver/cops:version-3.1.2-ls223

Expected Behavior

Cops should load correctly.

Steps To Reproduce

Just run the container from scratch with the above compose file.

Environment

- OS: n/a
- How docker service was installed: portainer stack/docker compose

CPU architecture

x86-64

Docker creation

services:
    cops:
        container_name: cops
        environment:
            - PUID=666
            - PGID=1337
            - TZ=America/Los_Angeles
        ports:
            - '127.0.0.1:5230:80'
        volumes:
            - '/docker/cops:/config'
            - '/ebooks:/books'
        restart: unless-stopped
        image: lscr.io/linuxserver/cops:version-3.1.2-ls223

Container logs

n/a

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[nopoz]

You can workaround this issue by running this custom-cont-init.d script at startup:

#!/usr/bin/env bash

# script to fix file permissions see https://github.com/linuxserver/docker-cops/issues/58

file="/app/www/public/config/local.php"

check_perm(){
	perm=$(stat -c "%a" "$file")
}

check_perm

if [[ "$perm" -eq 664 ]]; then
	echo "Permissions on $file are correct."
else
	echo "Permissions on $file are incorrect."
	echo "Current permissions are: $perm"
	echo "Changing to: 644"
	chmod 664 $file
	check_perm
	echo "Permissions on $file are now: $perm"
fi

[mikespub]

Hi @nopoz

is it possible you started with an existing file config_local.php with permissions -rwx------ in your local /docker/cops directory?

Because to help migration from older versions the current init-cops-config/run script will copy that to /config/config/local.php instead of using a new /defaults/config/local.php

When I try to install from scratch with an empty local /tmp/config and

        volumes:
            - /tmp/config:/config

I end up with a local.php file with permission 644 for my defined user locally, and for root inside the container, which is correct.

[nopoz]

Hi @mikespub I redid everything from scratch to sanity check my previous testing - no old config directory or anything. I get the same error:

Error loading local.php
Failed opening required '/app/www/public/config/local.php' (include_path='.:/usr/share/php83') in /app/www/public/config/config.php line 15

Checking the file permissions of /app/www/public/config/local.php inside the new container - they are the same as in the previous test:

# docker exec -t -i cops-test /bin/bash
root@1e1a373f1b85:/# ls -la /app/www/public/config/local.php
-rwx------ 1 root root 3993 Sep 12 12:16 /app/www/public/config/local.php

Checking the local.php file in the config directory as you mention, these are the permissions:

# ls -la /docker/cops-test/config/local.php
-rwx------ 1 cops ebooks 3993 Sep 12 12:14 /docker/cops-test/config/local.php

Compose file:

services:
    cops-test:
        container_name: cops-test
        environment:
            - PUID=666 # cops
            - PGID=1337 # ebooks
        ports:
            - 5231:80
        volumes:
            - /docker/cops-test:/config
            - /ebooks:/books
        restart: unless-stopped
        image: lscr.io/linuxserver/cops:3.1.2-ls223

[mikespub]

I'm sorry to hear that, and I can't reproduce here.

I'm afraid you'll need someone like @aptalca from linuxserver.io to track down what happens, because I'm seeing:

a. original /defaults/config/ dir in container

-rw-r--r-- 1 root root  3993 Sep 12 14:43 local.php

b. copied /config/config/ files in container

-rw-r--r-- 1 abc users 3993 Sep 13 19:29 local.php

c. final /app/www/public/config/ dir in container

-rw-rw-r-- 1 root root    22 Sep 12 14:14 .gitignore
-rw-rw-r-- 1 root root  1857 Sep 12 14:14 config.php
-rw-rw-r-- 1 root root 21928 Sep 12 14:14 default.php
-rw-rw-r-- 1 root root  2445 Sep 12 14:14 loader.php
-rw-r--r-- 1 root root  3993 Sep 13 19:29 local.php
-rw-rw-r-- 1 root root  2476 Sep 12 14:14 local.php.example
-rw-rw-r-- 1 root root   679 Sep 12 14:14 test.php

d. new /tmp/config/config/ files on local server

-rw-r--r-- 1 mikespub mikespub 3993 Sep 13 21:29 local.php

[aptalca]

I can't reproduce this either. Only thing I can think of is /docker/cops is a remote mount that mangles permissions.

If so, we don't support /config folders being on remote mounts for various reasons including this one.

Try creating a container without the config folder mapped at all, let the folder be created inside the container and see if that works. If it does, then it's your host folder that's the problem.

[mikespub]

Thanks for picking this up @aptalca

I was thinking it could be some umask issue, but then I couldn't figure out how it might end up being executable on the host, and I wasn't sure how using s6-overlay would affect all that.

Either way, your PR should resolve all that, thanks :-)