Server: New installation fails with permission denied

[xoaaC]

I just wanted to update my bitwarden on-premise installation and it gave me following error:
IOError: [Errno 13] Permission denied: u'/home/user/bitwarden/bwdata/docker/global.env'
It seems like it has something to with the recent changes in https://github.com/bitwarden/core/issues/170

Docker/Bitwarden is run an non-root user who got added to docker and sudo group.
After i ran chmod 777 for the files inside the docker and env folder I got it to start.
(After i ran this command on the docker folder the env folder gave me the same error)

[kspearrin]

You would need to run the update commands from the same user that installed bitwarden or else permissions will be denied to those files.

[xoaaC]

There is only one user i could update from except for root of course.
I also tried a reinstall of bitwarden but it keeps giving me the same error.

[kspearrin]

Hmm. I am not sure really. I run the same install from my Macbook and have not run into this issue. What OS is this on?

[xoaaC]

Here is the systeminfo:
centos-release-7-4.1708.el7.centos.x86_64
Operating System: CentOS Linux 7 (Core)
CPE OS Name: cpe:/o:centos:centos:7
Kernel: Linux 3.10.0-693.5.2.el7.x86_64
Architecture: x86-64

[dclabry]

I've run into basically the same issue. I did a fresh install on Ubuntu 17.10 and then it failed to start. My user is a member of the docker group, so I can run docker-compose, it just can't read some of the files in the bwdata directory.

user@bitwarden:~$ ./bitwarden.sh update
 _     _ _                         _
| |__ (_) |___      ____ _ _ __ __| | ___ _ __
| '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \
| |_) | | |_ \ V  V / (_| | | | (_| |  __/ | | |
|_.__/|_|\__| \_/\_/ \__,_|_|  \__,_|\___|_| |_|

Open source password management solutions
Copyright 2015-2018, 8bit Solutions LLC
https://bitwarden.com, https://github.com/bitwarden

===================================================

Docker version 17.12.0-ce, build c97c6d6
docker-compose version 1.18.0, build 8dd22a9

Traceback (most recent call last):
  File "bin/docker-compose", line 6, in <module>
  File "compose/cli/main.py", line 71, in main
  File "compose/cli/main.py", line 121, in perform_command
  File "compose/cli/command.py", line 37, in project_from_options
  File "compose/cli/command.py", line 91, in get_project
  File "compose/config/config.py", line 392, in load
  File "compose/config/config.py", line 488, in load_services
  File "compose/config/config.py", line 467, in build_services
  File "compose/config/config.py", line 460, in build_service
  File "compose/config/config.py", line 831, in finalize_service
  File "compose/config/config.py", line 644, in resolve_environment
  File "compose/config/environment.py", line 35, in env_vars_from_file
  File "codecs.py", line 896, in open
IOError: [Errno 13] Permission denied: u'/home/user/bwdata/docker/global.env'
Failed to execute script docker-compose

user@bitwarden:~/bwdata/docker$ ls -l
total 12
-rw-r--r-- 1 root root 1671 Jan 17 22:03 docker-compose.yml
-rw------- 1 root root  443 Jan 17 22:03 global.env
-rw------- 1 root root   51 Jan 17 22:03 mssql.env

[xoaaC]

@kspearrin Any news on when this change gets reverted or the issue gets solved in another way?
I understand that the content in this file is sensitive security wise.

[kspearrin]

I am not sure what other option there is to properly handle this yet.

[jokoso]

The directories and files generated by the install script end up being owned by root instead of the user executing ./bitwarden.sh install. The following command can be used to reclaim ownership:

sudo chown -R <username>:<user group> .

[kspearrin]

It seems that since the containers are currently running as root you also need to run the ./bitwarden.sh script with sudo or you run into this problem. We will investigate how to utilize the docker group from the images properly. This is also being discussed in #221.

[lsim]

Good to know. Seeing as ./bitwarden.sh update fails silently when run as a normal user, it might be good to add a note on this page until this gets addressed.

[kspearrin]

This should be resolved in the next version since sudo will no longer be required. See https://github.com/bitwarden/core/issues/221#issuecomment-376749036

[kspearrin]

Closing since this is fixed in next version. sudo will no longer be required and all mapped volumes will be owned by the user running the bitwarden script.

[saschpe]

Looks like this is back or was never solved:

./bitwarden.sh update
...
Docker version 18.09.8, build bfed4f5
docker-compose version 1.24.0, build 0aa59064
...
1.36.1: Pulling from bitwarden/setup
Digest: sha256:5b2c43b46c03da54aecc6d19098b0574b5fb205f0cd3046019725925cadfdf29
Status: Image is up to date for bitwarden/setup:1.36.1

Building docker environment files.
Building docker environment override files.
Building nginx config.
Unhandled exception. System.UnauthorizedAccessException: Access to the path '/bitwarden/nginx/default.conf' is denied.
 ---> System.IO.IOException: Permission denied
   --- End of inner exception stack trace ---
   at Interop.ThrowExceptionForIoErrno(ErrorInfo errorInfo, String path, Boolean isDirectory, Func`2 errorRewriter)
   at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String path, OpenFlags flags, Int32 mode)
   at System.IO.FileStream.OpenHandle(FileMode mode, FileShare share, FileOptions options)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
   at System.IO.StreamWriter.ValidateArgsAndOpenPath(String path, Boolean append, Encoding encoding, Int32 bufferSize)
   at System.IO.StreamWriter..ctor(String path, Boolean append)
   at System.IO.File.CreateText(String path)
   at Bit.Setup.NginxConfigBuilder.Build(TemplateModel model) in /home/runner/work/server/server/util/Setup/NginxConfigBuilder.cs:line 66
   at Bit.Setup.NginxConfigBuilder.BuildForUpdater() in /home/runner/work/server/server/util/Setup/NginxConfigBuilder.cs:line 53
   at Bit.Setup.Program.RebuildConfigs() in /home/runner/work/server/server/util/Setup/Program.cs:line 255
   at Bit.Setup.Program.Update() in /home/runner/work/server/server/util/Setup/Program.cs:line 140
   at Bit.Setup.Program.Main(String[] args) in /home/runner/work/server/server/util/Setup/Program.cs:line 65