RPM/DEB packages: change permissions/ownership of config and bin plugins dirs

[tlrx]

When installing elasticsearch with a RPM or DEB package, the configuration directory /etc/elasticsearch should be owned by user root and group elasticsearch with 750 permissions (root has full access, read/list access for users of elasticsearch group and nothing for others users)

When installing a plugin that contains configuration files like /etc/elasticsearch/awesome-plugin/, the plugin directory should be owned by user root and group elasticsearch with 750 permissions.

When installing a plugin that contains bin/ files like /usr/share/elasticsearch/bin/awesome-plugin/, the plugin directory and all its files should be owned by user root and group elasticsearch with 750 permissions (root has read/write/execute access, read/execute access for users of elasticsearch group and nothing for others users).

We also need to test how RPM/DEB packages handle permissions/ownership changes when upgrading a package.

[rjernst]

@tlrx Why is root ownership needed? Is this to make sure the ES process (which is run as a user in the elasticsearch group) cannot modify these files? It just seems weird that someone trying to configure e.g. elasticsearch.yml would need to run as root/sudo? But maybe it is just weird to me. :)

[rmuir]

It just seems weird that someone trying to configure e.g. elasticsearch.yml would need to run as root/sudo?

I don't think its wierd to require root/sudo to change configuration files in /etc at all.

[nik9000]

I don't think its wierd to require root/sudo to change configuration files in /etc at all.

+1

/etc/elasticsearch/* is owned by root with 444. World readable because why not and not world writable because its written by puppet.

[tlrx]

@rjernst yes, that's the idea. There was a debate about this but I think it makes sense, specially when elasticsearch is installed with a rpm/deb package (where rpm/dpkg commands often require to be executed as root)

[rjernst]

Ok thanks. LGTM

[ael-code]

I've installed Elasticsearch 1.5.2 on debian jessy through official elasticsearch repo.
First time I've launched systemctl start elasticsearch the bootstrap failed because of denied permission to create /usr/share/elasticsearch/data folder.

Error log:

May 13 10:02:59 debian8VM elasticsearch[792]: - ElasticsearchIllegalStateException[Failed to created node environment]
May 13 10:02:59 debian8VM elasticsearch[792]: AccessDeniedException[/usr/share/elasticsearch/data]
May 13 10:02:59 debian8VM elasticsearch[792]: org.elasticsearch.ElasticsearchIllegalStateException: Failed to created node environment
May 13 10:02:59 debian8VM elasticsearch[792]: at org.elasticsearch.node.internal.InternalNode.<init>(InternalNode.java:162)
May 13 10:02:59 debian8VM elasticsearch[792]: at org.elasticsearch.node.NodeBuilder.build(NodeBuilder.java:159)
May 13 10:02:59 debian8VM elasticsearch[792]: at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:70)
May 13 10:02:59 debian8VM elasticsearch[792]: at org.elasticsearch.bootstrap.Bootstrap.main(Bootstrap.java:213)
May 13 10:02:59 debian8VM elasticsearch[792]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:32)
May 13 10:02:59 debian8VM elasticsearch[792]: Caused by: java.nio.file.AccessDeniedException: /usr/share/elasticsearch/data

folder permissions just after package installation:

ls -lah /usr/share/elasticsearch
drwxr-xr-x   5 root          root          4.0K May 13 06:04 .
drwxr-xr-x 116 root          root          4.0K May 13 06:04 ..
drwxr-xr-x   2 root          root          4.0K May 13 06:04 bin
drwxr-xr-x   3 root          root          4.0K May 13 06:04 lib
-rw-r--r--   1 root          root           150 Apr 27 04:22 NOTICE.txt
drwxr-xr-x   2 elasticsearch elasticsearch 4.0K May 13 06:04 plugins
-rw-r--r--   1 root          root          8.3K Apr 27 04:22 README.textile

to solve the issue I've manually created the fodler:
drwxr-xr-x 3 elasticsearch elasticsearch 4.0K May 13 10:14 data

Do I need to open new issue or it is related to this one?

[tlrx]

@ael-code thanks for reporting. I think you hit the same issue as #10938 which will be fixed with #10725.