User's incrontab not working (only root's) when incrond is run as a service

Question

Here is my incrontab (tony's incrontab):

/home/tony/Workspace/cocoonr/ui/static/ui/img/icons/vector IN_MODIFY,IN_CREATE,IN_MOVED_TO /bin/sh /home/tony/Workspace/cocoonr/boilerplate/svg2djangohtml $@/$# /home/tony/Workspace/cocoonr/ui/templates/inc/icons/

I tested it multiple times changing some things, no way to make it work when incrond is run as a service (using openrc).

If I run incrond in foreground (incrond -n), then tony's incrontab works

If I set root's incrontab to the one given above, it works even when run as a service.

My tony is in /etc/incron.allow:

root
tony

And there is no /etc/incron.deny.

I even tried with a much simpler incrontab:

/tmp/foo IN_ATTRIB touch /tmp/bar

The results are the same.

How to make user's incrontab working?

Solution

If the binary for incrontab (which I don't know, never used it) hasn't his SGID bit set, that could cause this type of strange behaviour.

Set it with chmod g+s /path/to/binary (/usr/bin/incrontab, maybe?)

You can assess if it's set by:

ls -l /path/to/binary

(example)

ls -l /usr/bin/crontab
-rwxr-s--x 1 root crontab 44336 Jun 23 18:47 /usr/bin/crontab

Comments

[Atul]

Are there any errors in logs?

[Rafael Umbelino]

incrontab has no binary? SGID bit was already set? What was the situation?

[Antoine Pinsard]

/usr/bin/incrontab has SUID set. Owner is root, group is root. I tried to set SGID but it didn't work either.

[Rafael Umbelino]

Now that's strange. incrontab should run as root regardless of the user trying to execute it. But maybe we are onto something here. Group is root, right? Change it to crontab, set SGID bit and try again. Let's dig this one out.

[Antoine Pinsard]

I can't see the point in setting group crontab. incrontab is not related to crontab. Could you please explain the idea behind this?

[Rafael Umbelino]

Just a hunch based on the fact that I hit almost the same situation with another application that didn't work if I called as normal user, but worked fine as root. I had to change the binary's group to video so it could output to video. Go figure that one.

[Antoine Pinsard]

This doesn't change anything either. But anyway, the issue should not be about calling the incrontab executable. The daemon executes the commands as the same user whether it is root's incrontab or a user incrontab. And I think it reads it directly from files in /var/spool/incron/ rather than through the incrontab command.