Permission denied error when starting Gitea after updating to 1.17.0

[mpeter50]

Description

I have updated to Gitea 1.17.0, but when starting it I receive an error in the console, and then it exits. The message is available in the first file of my log gist.

In the docker compose file I have 2 volumes defined for use directly by Gitea:

• /mnt/gitea/data/ - /var/lib/gitea
• /mnt/gitea/custom - /etc/gitea

Gitea should run under user 1000, as set up in the docker compose file:

environment:
    - USER_UID=1000
    - USER_GID=1000

According to the console log, Gitea tries to create the /var/lib/gitea/custom/home directory, which is mapped to /mnt/gitea/data/custom/home on the host system.
After inspecting this latter path, I see that no one is granted write permissions on the custom directory in it:

/mnt/gitea/data $ ls -hal
total 20K
drwxr-xr-x  5 1000 1000 4.0K okt   29  2021 .
drwxr-xr-x  5 root root 4.0K jún   14  2021 ..
dr-x------ 13 1000 1000 4.0K nov   10  2021 custom
drwx------  5 1000 1000 4.0K márc  26 00:21 git
drwx------  2 root root 4.0K jún   13  2021 ssh

However, if I grant write permission to the owner with sudo chmod u+w custom, Gitea will still produce the same error on startup, then exit, and when exited, the write permission on the directory have disappeared.

I suspect that Gitea is unable to create the new home directory because it removes the write permission from it's parent directory, but I also suspect that I might be doing something wrong, as no one else has reported this bug yet.

If I try to fix this problem by hand, by manually creating the directory and setting ownership, as seen here:

sudo mkdir custom/home
sudo chown 1000:1000 custom/home

then starting up Gitea can continue a little, but will exit again because it wants yet another directory besides the new home one. The output from this run is in the second file in my log gist.

Gitea Version

v1.17.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

https://gist.github.com/mpeter50/c7ba7eb7fc5e74fd708736736800a4e6

Screenshots

No response

Git Version

2.36.2

Operating System

Raspbian

How are you running Gitea?

I'm running Gitea in Docker, for which I have built the container image myself, using the Docker.rootless DOckerfile in the repo.

Database

MySQL

[mpeter50]

For the time being, I have reverted to 1.16.5, and it seems to run as expected.

[zeripath]

Set [git].HOME_PATH to an appropriate place for your configuration in app.ini.

See the breaking changes notices in our blog post: https://blog.gitea.io/2022/07/gitea-1.17.0-is-released/#-internal-gitconfig-19732httpsgithubcomgo-giteagiteapull19732

Copied below:

Internal Gitconfig (#19732)

Previously, Gitea used the users gitconfig ($HOME/.gitconfig) in addition to the system gitconfig (/etc/gitconfig).

Now, Gitea uses the system gitconfig (/etc/gitconfig) combined with an internal gitconfig located in {[git].HOME_PATH}/.gitconfig. If you customized your user gitconfig for Gitea, you should add these customizations to one of the available gitconfigs. Additional git-relevant files that are normally in your user home directory, like $HOME/.gnupg, should be moved/ copied to {[git].HOME_PATH}/ as well.

[mpeter50]

Thank you for the information.

I've read the mentioned breaking change notices, and I haven't modified the gitconfig of the user that runs Gitea.

On the other hand, maybe I misunderstand something, but why should I override the git home path?

The current path is fine to me, and even more, I prefer it to be in the original location. The problem is that Gitea is unable to create this new directory, because it does not have permission to do so. I think this might be caused by Gitea trying to fix the permissions of its own directory, but does it wrongly, and it gets in its own way.

[zeripath]

The error you're receiving is stating it can't create what is the new default [git].HOME_PATH so I suggest you override this.

[mpeter50]

The error you're receiving is stating it can't create what is the new default

I understand, but is that expected behavior? Is this specific to the Docker environment? I'm asking because you have defined that path as the default for a reason.
As far as I'm aware I did not do anything to harden the filesystem permissions of Gitea directories, but Gitea itself does that, and in doing so it breaks itself. If this is the case, I think this is a bug.

[Draic]

I changed nothing to any ssh configs but the 1.17 update still breaks my SSH.

[techknowlogick]

What is the output of docker info?

[mpeter50]

$ sudo docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Docker Buildx (Docker Inc., v0.8.1-docker)

Server:
 Containers: 9
  Running: 9
  Paused: 0
  Stopped: 0
 Images: 27
 Server Version: 20.10.14
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runtime.v1.linux runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 3df54a852345ae127d1fa3092b95168e4a88e2f8
 runc version: v1.0.3-0-gf46b6ba
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 5.10.103-v7l+
 Operating System: Raspbian GNU/Linux 10 (buster)
 OSType: linux
 Architecture: armv7l
 CPUs: 4
 Total Memory: 1.87GiB
 Name: rpi
 ID: 3KSL:X4E5:RLEW:IP66:X6LR:CN5Z:Z7PV:DNNB:5TQF:KIPY:UMWV:AXXV
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No memory limit support
WARNING: No swap limit support
WARNING: No kernel memory TCP limit support
WARNING: No oom kill disable support

[zeripath]

The [git] HOME_PATH is a new setting from 1.17.

It defaults to APP_DATA_PATH/home. Where [server] APP_DATA_PATH is /data/gitea in the docker and thus /data/gitea/home

Simply create the directory /data/gitea/home on the docker and give Gitea permission to write to that directory.

[mpeter50]

It defaults to APP_DATA_PATH/home. Where [server] APP_DATA_PATH is /data/gitea in the docker and thus /data/gitea/home

In my configuration file [server] APP_DATA_PATH has the value /var/lib/gitea/custom.
I don't remember customizing this value, and according to the compose snippet in the Docker Rootless installation document, most of Gitea data is stored in the parent of this directory by default, so probably this was the default for Docker, at least when I started using Gitea.
I also don't have a /data directory in the container:

$ sudo docker exec -it gitea bash
bash-5.1$ ls -a /
.           ..          .dockerenv  app         bin         dev         etc         home        lib         media       mnt         opt         proc        root        run         sbin        srv         sys         tmp         usr         var
bash-5.1$ ls -a /var/lib/gitea
.       ..      custom  git     ssh

I haven't customized the value of [git] HOME_PATH (I don't have a git section), so this means it should point to APP_DATA_PATH/home, which is /var/lib/gitea/custom/home in my case.
According to the second paragraph in this document. Gitea should try to create the directories it needs, including this one. That is fine because it actually tries to create the directory at /var/lib/gitea/custom/home, but it fails, because it does not have write permissions on the directory /var/lib/gitea/custom:

$ sudo docker exec -it gitea bash
bash-5.1$ ls -hal /var/lib/gitea/custom
total 52K
dr-x------   13 git      git         4.0K Jul 31 18:34 .
drwxr-xr-x    5 git      git         4.0K Oct 29  2021 ..
drwxr-xr-x   19 git      git         4.0K Nov 12  2021 attachments
drwxr-xr-x    3 git      git         4.0K Sep 20  2021 avatars
drwxr-xr-x    2 git      git         4.0K Jul 31 11:31 conf
drwxr-xr-x    4 git      git         4.0K Jun 14  2021 indexers
drwxr-xr-x    2 git      git         4.0K Oct 22  2021 jwt
drwxr-xr-x    2 git      git         4.0K Jun 13  2021 log
drwxr-xr-x    8 git      git         4.0K Oct 22  2021 queues
drwxr-xr-x    2 git      git         4.0K Oct 22  2021 repo-archive
drwxr-xr-x    2 git      git         4.0K Jun 14  2021 repo-avatars
drwx------   18 git      git         4.0K May 24 20:11 sessions
drwxr-xr-x    3 git      git         4.0K Aug  1 23:50 tmp

As you may see, the permissions for the directory is only reading and execution for the git user.
I haven't modified the permissions, except trying to give the owner of the /var/lib/gitea/custom directory write permissions to it, but that was reverted as soon as Gitea started, and it still wasn't able to create the directories that it wanted.

---

Simply create the directory /data/gitea/home on the docker and give Gitea permission to write to that directory.

I don't have a /data directory, but if I try to create /var/lib/gitea/custom/home:

• I need to use sudo, because otherwise I don't have permissions
• I will just shift the problem a little bit: next I'll also need to create the packages directory, and who knows how much more, because Gitea won't be able to create that either

[swang-harbin]

I installed gitea 1.70 using sudo snap install gitea on Ubuntu 22.04 LTS, it doesn't automatically create /etc/gitea/app.ini.
I create a user called gitea and set its home directory to /var/lib/gitea , and execute sudo mkdir /var/lib/gitea && sudo chown gitee: /var/lib/gitea to modify permission. The gitea user has all access rights to /var/lib/gitea, as I understand it should not have this error.
The /etc/systemd/system/gitea.service is:

[Unit]
Description=Gitea (Git with a cup of tea)
After=syslog.target
After=network.target
Wants=mysql.service
After=mysql.service

[Service]
RestartSec=2s
Type=simple
User=gitea
Group=gitea
WorkingDirectory=/var/lib/gitea/
RuntimeDirectory=gitea
ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
Restart=always
Environment=USER=gitea HOME=/var/lib/gitea/ GITEA_WORK_DIR=/var/lib/gitea

[Install]
WantedBy=multi-user.target

When I set the Repository Root Path to /var/lib/gitea/common/data/gitea-repositories and Run As Username to gitea on the initial configuration page, it cannot be installed successfully, and it prompts The repository root path is invalid: mkdir / var/lib/gitea: read-only file system.
I don't know what [git].HOME_PATH is or where it is, because it doesn't have a default configuration file nor is it detailed in the installation process.
I think if [git].HOME_PATH is mandatory, then it should have a default configuration, or specify it before startup as an environment variable. This configuration confuses people.

[chris-fj]

I am receiving the same error. I have the following mount:

- /home/git/.gitconfig:/data/gitea/home/.gitconfig

and I have set the following env definitions

GITEA__git__HOME_PATH=/data/gitea/home
USER_UID=116
USER_GID=123

and the file .gitconfig has the following permissions

$ sudo -u git ls -ln /home/git/.gitconfig 
-rw-rw-r-- 1 116 123 1 Aug 16 21:57 /home/git/.gitconfig

however, when starting up the container, I receive this error:

- error: could not lock config file /data/gitea/home/.gitconfig: Permission denied

I understand that the user whose UID/GID is defined in the environment is the one performing the operations and, as stated in the ls command, said user can read/write the .gitconfig file. Am I missing something here?