/var permission denied (770 vs 755)

Yesterday I got these errors:

The "named" service failed to start.

named: exiting (due to fatal error)
named: loading configuration: permission denied
named: /etc/named.conf:20: parsing failed
named: /etc/named.conf:20: change directory to '/var/named' failed: permission denied
named: loading configuration from '/etc/named.conf'

warn [tailwatchd] Failed to send notification of type "EMAIL": Cannot open main log file "/var/log/exim_mainlog": Permission denied

warn [cpanel] User file '/var/cpanel/users/{username}' is empty or non-existent. at /usr/local/cpanel/Cpanel/Config/LoadCpUserFile.pm line 296.

It turns out that the issue was that the file permissions on the /var folder were incorrect: [SPOILER="Full root dir ls -la">

root@hosting [/scripts]# cd /
root@hosting [/]# ls -la
totaal 222
dr-xr-xr-x.  23 root root  4096 nov 17 08:21 ./
dr-xr-xr-x.  23 root root  4096 nov 17 08:21 ../
-rw-------.   1 root root 10240 nov 17 08:46 aquota.group
-rw-r--r--.   1 root root 10240 nov 17 08:46 aquota.user
-rw-r--r--.   1 root root     0 nov 17 08:21 .autofsck
drwx--x--x.   7 root root  4096 nov 17 08:45 backup/
dr-xr-xr-x.   2 root root  4096 nov 11 01:08 bin/
dr-xr-xr-x.   5 root root  1024 mrt 20  2015 boot/
drwxr-xr-x.  18 root root  3520 nov 17 08:22 dev/
drwxr-xr-x.  76 root root 12288 nov 17 08:45 etc/
drwx--x--x.   9 root root  4096 aug  5 01:20 home/
dr-xr-xr-x.   8 root root  4096 aug  7 01:02 lib/
dr-xr-xr-x.   8 root root 12288 nov 11 01:08 lib64/
drwx------.   2 root root 16384 jan 19  2015 lost+found/
drwxr-xr-x.   2 root root  4096 sep 23  2011 media/
drwxr-xr-x.   2 root root  4096 sep 23  2011 mnt/
drwxr-xr-x.  10 root root  4096 jul  9 17:02 opt/
dr-xr-xr-x. 149 root root     0 nov 17 08:21 proc/
-rw-r--r--.   1 root root   108 jan 29  2015 razor-agent.log
dr-xr-x---.  18 root root  4096 nov 17 08:22 root/
dr-xr-xr-x.   2 root root 12288 nov 11 01:07 sbin/
lrwxrwxrwx.   1 root root    25 jan 29  2015 scripts -> /usr/local/cpanel/scripts/
drwxr-xr-x.   7 root root     0 nov 17 08:21 selinux/
drwxr-xr-x.   2 root root  4096 sep 23  2011 srv/
drwxr-xr-x   13 root root     0 nov 17 08:21 sys/
drwxrwxrwt.  10 root root 81920 nov 17 08:22 tmp/
drwxr-xr-x.  13 root root  4096 jan 19  2015 usr/
drwxrwx---.  22 root root  4096 nov 11 01:01 var/

Note the last line:
drwxrwx---. 22 root root 4096 nov 11 01:01 var/
You can see here that the permission is set to 770 (`drwxrwx---`) Just running this command solved all the issues:
chmod 755 /var
I'm putting this out here for two reasons: 1. It would be nice if the next person who has this issue can just google it. 2. I want to find out how the permission on the /var folder got changed from 755 to 770. (Version: 11.52.1 (build 0), and update runs every day, the last log looks good.)

cPanelMichael

November 18, 2015 17:57

Hello :) I've been unable to reproduce a permission change on the /var/named directory to 0770 during cPanel updates. Is it possible the directory was changed manually by an administrator, or by a third-party application? Thank you.

Daan Garde

November 19, 2015 07:08

Thank you for trying this out! Much appreciated! However, it is not the /var/named directory, but the /var directory itself. (Wich makes it more strange) It is almost impossible that this was done by an administrator, as there is no root login and just one other user in the root group. That other user account is only used by one other administrator and he didn't login that day. A third-party app seems unlikely as it is a pretty clean install. The only extra option is Installatron and that is in cPanel, not other processes or cron jobs are running/installed. On the other hand, I have five similar setups running with no issues at all, so it looks like an isolated incident. (The other admin complained that the account seems to have different permissions under SSH than under FTP, so I might look into that more, or check the SELinux file statuses) Back in 2005 someone had the same issue (Exim DEAD! please Help | Web Hosting Talk), but also in that case, the reason of the permission change is unclear. For now, as this issue only occurred on one server, I assume this is an environment specific issue. If I ever find out what the cause is of the issue, I will update this post. Thank you!

/var permission denied (770 vs 755)

Comments

Didn't find what you were looking for?