Fpm: How to set ownership and permissions of files installed by deb package?

[kzidane]

Hi,

so I'm generating deb package from dir. saw this answer by @jordansissel, but still confused as for what --deb-use-file-permissions is exactly used for.

when I chmod the files to be packaged, build the deb, and

sudo dpkg -i package.deb

to install, I get the files chmoded correctly after getting installed, and owned by root:root (which is what I expect since I used sudo), but if I add the --deb-use-file-permissions option, the files are instead owned by the non-root user executing the command above after installation (even though I still use sudo when installing). is this normal?

another question just to be sure, should I assume that the permissions that I set before packaging are the same that are gonna end up set after installing? any particular options I should provide to guarantee that?

thanks!

[jordansissel]

File ownership is a tricky thing in debs, in my experience. The --deb-use-file-permissions creates a package with the files owned by within the package.

Debian packages internally use a tarball for the files to place on disk. Here's the differences between with and without that flag:

# Who owns the file?
% ls -l ~/.zshrc
-rw-r--r--. 1 jls jls 13887 May 23 14:03 /home/jls/.zshrc

# Without the flag
% fpm -s dir -t deb -n example ~/.zshrc
% ar p "example_1.0_amd64.deb" data.tar.gz | tar -zvt ./home/jls/.zshrc
-rw-r--r-- 0/0           13887 2016-05-23 14:03 ./home/jls/.zshrc

# With the flag
% fpm -s dir -t deb --deb-use-file-permissions -n example ~/.zshrc
% ar p "example_1.0_amd64.deb" data.tar.gz | tar -zvt ./home/jls/.zshrc
-rw-r--r-- jls/jls       13887 2016-05-23 14:03 ./home/jls/.zshrc

Without the flag, the file is owned by 0 (root). With the flag, the file is owned by the user who owned the file at package-time.

---

This should mean that, with the flag used, the file ownership should be carried into the package and be the same after you install.

I think you've found a bug, though, I'm not sure what's causing it.

Here's how I reproduce it:

Create a new file owned by nobody user

% touch /tmp/example.file
% chown nobody /tmp/example.file
% ls -l /tmp/example.file
-rw-r--r-- 1 nobody jls 0 Aug  5 17:39 /tmp/example.file

Package it up

% fpm -s dir -t deb -n example --deb-use-file-permissions /tmp/example.file=/opt/example/
Created package {:path=>"example_1.0_amd64.deb"}

Check the file ownership in the package

% ar p example_1.0_amd64.deb data.tar.gz | tar -zvt
drwx------ jls/jls           0 2016-08-05 17:43 ./
drwxr-xr-x jls/jls           0 2016-08-05 17:43 ./opt/
drwxr-xr-x jls/jls           0 2016-08-05 17:43 ./opt/example/
-rw-r--r-- jls/jls           0 2016-08-05 17:39 ./opt/example/example.file
drwxr-xr-x jls/jls           0 2016-08-05 17:43 ./usr/
drwxr-xr-x jls/jls           0 2016-08-05 17:43 ./usr/share/
drwxr-xr-x jls/jls           0 2016-08-05 17:43 ./usr/share/doc/
drwxr-xr-x jls/jls           0 2016-08-05 17:43 ./usr/share/doc/example/
-rw-r--r-- jls/jls         133 2016-08-05 17:43 ./usr/share/doc/example/changelo

Strange indeed. The owner should be set to whoever owns each file originally, but it's not.

I think I know what's going on. When fpm is staging the files for packaging, it copies them, and if you aren't root, you can't apply ownership. When fpm is run as non-root, this causes the file ownership to be all owned by the user executing fpm.

I can see this work if I create the package with fpm as root (not recommended):

% ar p example_1.0_amd64.deb data.tar.gz | tar -zvt
drwx------ root/root         0 2016-08-05 17:45 ./
drwxr-xr-x root/root         0 2016-08-05 17:45 ./opt/
drwxr-xr-x root/root         0 2016-08-05 17:45 ./opt/example/
-rw-r--r-- nobody/jls        0 2016-08-05 17:39 ./opt/example/example.file
drwxr-xr-x root/root         0 2016-08-05 17:45 ./usr/
drwxr-xr-x root/root         0 2016-08-05 17:45 ./usr/share/
drwxr-xr-x root/root         0 2016-08-05 17:45 ./usr/share/doc/
drwxr-xr-x root/root         0 2016-08-05 17:45 ./usr/share/doc/example/
-rw-r--r-- root/root       133 2016-08-05 17:45 ./usr/share/doc/example/changelo