Don't have permission to exec library in cache directory

pavelprosto

I am making a GUI for transmission-cli (tested this)
Communication with the program is carried out through subprocess.

self.PROCESS = subprocess.Popen(cmd_args,
                                stdout=subprocess.PIPE,
                                stderr=subprocess.STDOUT,
                                universal_newlines=True,
                                cwd=path)

it's this line

The library works, is in the cache directory of the program, runs from the cache directory, loads everything into the cache directory, the working files of the program are in the cache directory. EVERYTHING IS IN THE CASH DIRECTORY
But if you run the program without "template": "unconfined" in transmission.apparmor, the library will give an error:
[Error 13] Permission denied

I tried to execute simpler commands (ls, echo) and I got an error:
[Error 13] Permission denied
Does anyone have any idea what permission can be given to the program so that it can work without the template : unconfined

Source code here

dobey

@pavelprosto What is the exact command and log message? Why is it trying to execute things from cache directory? There should also be an apparmor denial message either in your app's log file, or in /var/log/syslog when the command is attempted, assuming it is an apparmor denial causing the issue.

pavelprosto

@dobey how can i watch the command execution in /var/log/syslog ?
I have compiled transmission-cli and it works
I communicate with this console program via subprocess.
Currently, the application can only run through the unconfined apparmor. Which is not very safe.
I'm trying to figure out what permissions I need to add so that transmission-cli can work with fixed permissions.

In the program log I get only one message:
[Error 13] Permission denied
What exactly is prohibited, why does it not tell

pavelprosto

@dobey As I understand it, the problem lies in creating an isolated environment.
In these lines, I am creating an isolated environment:
https://github.com/pavelprosto94/transmission/blob/main/src/main.py#L28

But this is not enough. Apparently I need to add some permissions to read the system catalogs

dobey

@pavelprosto Why aren't you including pre-built transmission binaries in the click package, instead of trying to install in the cache directory after?

You can use the terminal app, or ssh or adb connection to your phone, and tail -f /var/log/syslog to check it.

pavelprosto

@dobey Because this is a QML + Python project.
I included transmission in the project, everything exactly turns out this error.

[Error 13] Permission denied

transmission is unpacked and launched from the cache directory, because I wanted to make it possible to use armhl or arm64 binaries(depending on the type of operating system).
Therefore, unpacking and working in the cache directory is the best option.
about tail -f /var/log/syslog

Feb 15 21:59:01 ubuntu-phablet kernel: [35852.054250] android_work: sent uevent USB_STATE=CONFIGURED
Feb 15 21:59:01 ubuntu-phablet kernel: [35852.127191] mtp_open
Feb 15 21:59:02 ubuntu-phablet kernel: [35853.214266] bq24192_set_input_i_limit: input current limit = 500 setting 0x02
Feb 15 21:59:06 ubuntu-phablet kernel: [35857.173828] lm3630_backlight_off
Feb 15 21:59:06 ubuntu-phablet kernel: [35857.416723] mdss_dsi_panel_off:
Feb 15 21:59:06 ubuntu-phablet kernel: [35857.440202] [Touch] touch off
Feb 15 21:59:06 ubuntu-phablet kernel: [35857.558167] [Touch] touch on
Feb 15 21:59:06 ubuntu-phablet kernel: [35857.757974] mdss_dsi_panel_on
Feb 15 21:59:07 ubuntu-phablet kernel: [35857.822296] lm3630_backlight_on
Feb 15 21:59:47 ubuntu-phablet kernel: [35898.197099] max17048_work: rsoc=0xC121 rvcell=0x0D99 soc=99 v_mv=4351 i_ua=-183791 t=204
Feb 15 22:00:10 ubuntu-phablet dbus[823]: [system] Activating service name='com.canonical.PropertyService' (using servicehelper)
Feb 15 22:00:10 ubuntu-phablet dbus[823]: [system] Successfully activated service 'com.canonical.PropertyService'
Feb 15 22:01:26 ubuntu-phablet kernel: [35997.549041] max17048_work: rsoc=0xC20E rvcell=0x0D99 soc=100 v_mv=4351 i_ua=-164215 t=221
Feb 15 22:03:30 ubuntu-phablet kernel: [36120.885950] max17048_work: rsoc=0xC323 rvcell=0x0D9A soc=100 v_mv=4352 i_ua=-153072 t=231

no messages from my program

pavelprosto

Updated!
tail -f /var/log/syslog

Feb 15 22:10:55 ubuntu-phablet dbus[2547]: apparmor="DENIED" operation="dbus_method_call"  bus="session" path="/com/canonical/libertine/Service/Operations" interface="com.canonical.libertine.Service.Operations" member="list" mask="send" name="com.canonical.libertine.Service" pid=11834 label="transmission.pavelprosto_transmission_1.0.1" peer_pid=3517 peer_label="unconfined"
Feb 15 22:10:55 ubuntu-phablet dbus[2547]: apparmor="DENIED" operation="dbus_method_call"  bus="session" path="/com/canonical/libertine/Service/OperationsMonitor" interface="com.canonical.libertine.Service.OperationsMonitor" member="running" mask="send" name="com.canonical.libertine.Service" pid=11834 label="transmission.pavelprosto_transmission_1.0.1" peer_pid=3517 peer_label="unconfined"
Feb 15 22:10:55 ubuntu-phablet dbus[2547]: apparmor="DENIED" operation="dbus_method_call"  bus="session" path="/com/canonical/libertine/Service/OperationsMonitor" interface="com.canonical.libertine.Service.OperationsMonitor" member="last_error" mask="send" name="com.canonical.libertine.Service" pid=11834 label="transmission.pavelprosto_transmission_1.0.1" peer_pid=3517 peer_label="unconfined"
Feb 15 22:10:55 ubuntu-phablet dbus[2547]: apparmor="DENIED" operation="dbus_method_call"  bus="session" path="/com/canonical/libertine/Service/OperationsMonitor" interface="com.canonical.libertine.Service.OperationsMonitor" member="result" mask="send" name="com.canonical.libertine.Service" pid=11834 label="transmission.pavelprosto_transmission_1.0.1" peer_pid=3517 peer_label="unconfined"

dobey

@pavelprosto Those denials are about libertine dbus service, not executing files in the cache directory; so you can ignore them.

pavelprosto

@dobey There were no other messages

Keneda

@dobey
I'm not a dev, but that made me wonder : why a "native" uTouch click app would trigger libertine?

dobey

@pavelprosto said in Don't have permission to exec library in cache directory:

Because this is a QML + Python project.
I included transmission in the project, everything exactly turns out this error.

Sure, but you can build separate click packages for each architecture, which pulls the approriate transmission binaries in, and will reduce the size of your package versus shipping the same thing on all architectures.

Also, please can you state the exact command line which your app is trying to run with subprocess.Popen here? I see in your code that you're raising an exception which includes that, but I have not seen that posted here. Also, it looks like you're defining CACHEPATH based on the path of __file__ which should I guess be pointing at the installed path of your package.

pavelprosto

@dobey command:

transmission-cli --config-dir "/home/phablet/.cache/transmission.pavelprosto/" -p 51414 -w "/home/phablet/.cache/transmission.pavelprosto/Download/" -d 1024 -u 256 -ep "/home/phablet/.cache/transmission.pavelprosto/manjaro-kde-20.2.1-210103-linux59.iso.torrent"

Environment:
"HOME" : "/home/phablet/.cache/transmission.pavelprosto/"
"PWD" : "/home/phablet/.cache/transmission.pavelprosto/"
"TMPDIR" : "/home/phablet/.cache/transmission.pavelprosto/tmp"
"PATH" : "/home/phablet/.cache/transmission.pavelprosto//transmission/bin"
"LD_LIBRARY_PATH" : "/home/phablet/.cache/transmission.pavelprosto/transmission/lib/"
"PKG_CONFIG_PATH" : "/home/phablet/.cache/transmission.pavelprosto/transmission/lib/pkgconfig"

pavelprosto

@keneda I also find it strange. libertine is not used in my program, where it came from, I don't understand

dobey

@pavelprosto OK. So, yes, apps cannot execute things in the cache or config directories for the app, but can execute things from the app's data directory ~/.local/share/${APP_PKG_NAME}/ instead.

Also, cache is things expected to be OK for the user to remove and have the app still working. I suspect your app shouldn't be unpacking transmission into the cache directory on every start.

Rather, my best suggestion is still to include the transmission binaries in the click package itself, and have them installed alongside your app's python and QML. lib/${ARCH_TRIPLET}/bin inside your click package, is already in the ${PATH} for your app, and lib/${ARCH_TRIPLET} already part of ${LD_LIBRARY_PATH}, so you don't need to mess with the environment like that, either.

pavelprosto

@dobey THANK YOU VERY MUCH!
It is fantastic! Everything works with safe permission
I finish the final touches and publish in OpenStore

pavelprosto

If someone needs to create a front-end wrapper for a binary console program, here's how it can be implemented

create global environment
glob.py

import os

APP_PKG_NAME = os.path.abspath(__file__)
APP_PKG_NAME = APP_PKG_NAME[APP_PKG_NAME.find(".com/")+5:]
APP_PKG_NAME = APP_PKG_NAME[:APP_PKG_NAME.find("/")]
SCRIPTPATH = os.path.abspath(__file__)
SCRIPTPATH = SCRIPTPATH[:SCRIPTPATH.rfind('/')]

CACHEPATH = "/home/phablet/.cache/"+APP_PKG_NAME
DATAPATH = "/home/phablet/.local/share/"+APP_PKG_NAME
CONFIGPATH = "/home/phablet/.config/"+APP_PKG_NAME

DOWNLOADPATH = CACHEPATH+"/Download"
TMPPATH = CACHEPATH+"/tmp"
RESUMEPATH   = CACHEPATH+"/resume/"
TORRENTSPATH = CACHEPATH+"/torrents/"

MY_ENV = {"HOME" : CACHEPATH }
MY_ENV["PWD"] = CACHEPATH
MY_ENV["TMPDIR"] = CACHEPATH+"/tmp"
MY_ENV["PATH"] = DATAPATH+"/transmission/bin"
MY_ENV["LD_LIBRARY_PATH"] = DATAPATH+"/transmission/lib/"
MY_ENV["PKG_CONFIG_PATH"] = DATAPATH+"/transmission/lib/pkgconfig"

if not os.path.exists(DATAPATH):
    try:
        os.makedirs(DATAPATH)
    except Exception as e:
        print("Can't create DATAPATH dir:\n"+DATAPATH)
        print(e)

if not os.path.exists(CONFIGPATH):
    try:
        os.makedirs(CONFIGPATH)
    except Exception as e:
        print("Can't create CONFIGPATH dir:\n"+CONFIGPATH)
        print(e)

if not os.path.exists(CACHEPATH):
    try:
        os.makedirs(CACHEPATH)
    except Exception as e:
        print("Can't create CACHEPATH dir:\n"+CACHEPATH)
        print(e)

if not os.path.exists(DOWNLOADPATH):
    try:
        os.makedirs(DOWNLOADPATH)
    except Exception as e:
        print("Can't create DOWNLOAD dir:\n"+DOWNLOADPATH)
        print(e)

if not os.path.exists(TMPPATH):
    try:
        os.makedirs(TMPPATH)
    except Exception as e:
        print("Can't create TMP dir:\n"+TMPPATH)
        print(e)

Correct location of all files is very important!!!
DATAPATH: contains all executables and libraries
CONFIGPATH: contains the settings for your application. But not settings for a binary console program, its settings must be stored in CACHEPATH
CACHEPATH: contains all files resulting from program execution.
Now you will be able to launch and communicate with the console program through your environment:

...
import subprocess
import re
import shlex
import glob
...
CMD="transmission-show"
def strip_color(s):
   return re.sub('\x1b\\[(K|.*?m)', '', s)

def _process(command_string, path=""):
       cmd_args = shlex.split(command_string)
       try:
           PROCESS = subprocess.Popen(cmd_args,
                               stdout=subprocess.PIPE,
                               stderr=subprocess.STDOUT,
                               universal_newlines=True,
                               shell=False,
                               executable=None,
                               env=glob.MY_ENV,
                               cwd=path)
       except Exception as e:
           yield strip_color(str(e))
       else:
           for stdout_line in iter(PROCESS.stdout.readline, ''):
               yield strip_color(stdout_line)
           PROCESS.stdout.close()
           return_code = PROCESS.wait()
           if return_code:
               raise subprocess.CalledProcessError(return_code, command_string)
...
for stdout_line in _process(CMD+" \""+FILENAME+"\"", glob.CACHEPATH):
   print(stdout_line)
...

CiberSheep

@pavelprosto said in Don't have permission to exec library in cache directory:

If someone needs to create a front-end wrapper for a binary console program, here's how it can be implemented

Have you thought about joining forces with @aarontheissueguy and creating a git*b project for the template?

pavelprosto

@cibersheep Yes,I want to write a guide. But first I need to make sure it works for all console programs.
I tried, add the previous guides in github
https://docs.ubports.com/en/latest/appdev/guides/index.html

But something didn't work out for me. I try will do this in spare time