創建文件夾時系統權限被拒絕

我正在嘗試安裝InfluxDB 2.0並按照此處的說明進行操作Centos 7。所以，我的服務文件是：/lib/systemd/system/influxdb.service及其內容：

[Unit]
Description=InfluxDB 2.0 service file.
Documentation=https://v2.docs.influxdata.com/v2.0/get-started/
After=network-online.target

[Service]
User=influxdb
Group=influxdb
ExecStart=/usr/local/bin/influxd
Restart=on-failure

[Install]
WantedBy=multi-user.target

並ls輸入文件：

[vagrant@localhost ~]$ ls /lib/systemd/system/inf* -l
-rw-r--r--. 1 root root 268 Oct 17 09:54 /lib/systemd/system/influxdb.service

Influxdb 二進製文件在這裡：

[vagrant@localhost ~]$ ls /usr/local/bin/inf* -l
-rwxr-xr-x. 1 influxdb influxdb 33235536 Oct 17 09:46 /usr/local/bin/influx
-rwxr-xr-x. 1 influxdb influxdb 95804192 Oct 17 09:46 /usr/local/bin/influxd

Systemd 服務狀態為：

[vagrant@localhost ~]$ systemctl status influxdb.service
● influxdb.service - InfluxDB 2.0 service file.
  Loaded: loaded (/usr/lib/systemd/system/influxdb.service; enabled; vendor preset: disabled)
  Active: active (running) since Sat 2020-10-17 11:39:54 UTC; 16min ago
    Docs: https://v2.docs.influxdata.com/v2.0/get-started/
Main PID: 13398 (influxd)
  CGroup: /system.slice/influxdb.service
          └─13398 /usr/local/bin/influxd

但是，該服務無法正常工作並且正在尋找sudo journalctl | grep influxdb | less ，我發現了這個：

Oct 17 09:46:27 localhost.localdomain sudo[16616]:  vagrant : TTY=pts/0 ; PWD=/opt/influxdb-2.0.0-rc.1_linux_amd64 ; USER=root ; COMMAND=/bin/cp ./{influx, influxd} /usr/local/bin
Oct 17 09:46:37 localhost.localdomain sudo[16619]:  vagrant : TTY=pts/0 ; PWD=/opt/influxdb-2.0.0-rc.1_linux_amd64 ; USER=root ; COMMAND=/bin/cp {influx, influxd} /usr/local/bin
Oct 17 09:46:52 localhost.localdomain sudo[16634]:  vagrant : TTY=pts/0 ; PWD=/opt/influxdb-2.0.0-rc.1_linux_amd64 ; USER=root ; COMMAND=/bin/cp influx influxd /usr/local/bin
Oct 17 09:50:31 localhost.localdomain sudo[16653]:  vagrant : TTY=pts/0 ; PWD=/usr/lib/systemd/system ; USER=root ; COMMAND=/sbin/useradd -rs /bin/false influxdb
Oct 17 09:50:31 localhost.localdomain useradd[16655]: new group: name=influxdb, GID=993
Oct 17 09:50:31 localhost.localdomain useradd[16655]: new user: name=influxdb, UID=996, GID=993, home=/home/influxdb, shell=/bin/false
Oct 17 09:50:42 localhost.localdomain sudo[16661]:  vagrant : TTY=pts/0 ; PWD=/usr/lib/systemd/system ; USER=root ; COMMAND=/bin/touch /lib/systemd/system/influxdb.service
Oct 17 09:51:14 localhost.localdomain sudo[16677]:  vagrant : TTY=pts/0 ; PWD=/usr/lib/systemd/system ; USER=root ; COMMAND=/bin/vim influxdb.service
Oct 17 09:58:42 localhost.localdomain sudo[16708]:  vagrant : TTY=pts/0 ; PWD=/usr/lib/systemd/system ; USER=root ; COMMAND=/bin/systemctl start influxdb.service
Oct 17 09:58:56 localhost.localdomain influxd[16716]: ts=2020-10-17T09:58:56.784692Z lvl=error msg="Failed opening bolt" log_id=0PuVoU40000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:58:56 localhost.localdomain influxd[16716]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:58:56 localhost.localdomain influxd[16716]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:58:56 localhost.localdomain influxd[16716]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:58:56 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:58:56 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:58:56 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:58:57 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 09:59:10 localhost.localdomain influxd[16731]: ts=2020-10-17T09:59:10.994806Z lvl=error msg="Failed opening bolt" log_id=0PuVpL_W000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:59:10 localhost.localdomain influxd[16731]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:59:11 localhost.localdomain influxd[16731]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:59:11 localhost.localdomain influxd[16731]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:59:11 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:59:11 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:59:11 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:59:11 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 09:59:25 localhost.localdomain influxd[16745]: ts=2020-10-17T09:59:25.253903Z lvl=error msg="Failed opening bolt" log_id=0PuVqDHG000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:59:25 localhost.localdomain influxd[16745]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:59:25 localhost.localdomain influxd[16745]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:59:25 localhost.localdomain influxd[16745]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:59:25 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:59:25 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:59:25 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:59:25 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 09:59:39 localhost.localdomain influxd[16759]: ts=2020-10-17T09:59:39.280461Z lvl=error msg="Failed opening bolt" log_id=0PuVr440000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:59:39 localhost.localdomain influxd[16759]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:59:39 localhost.localdomain influxd[16759]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:59:39 localhost.localdomain influxd[16759]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:59:39 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:59:39 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:59:39 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:59:39 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 09:59:53 localhost.localdomain influxd[16778]: ts=2020-10-17T09:59:53.202433Z lvl=error msg="Failed opening bolt" log_id=0PuVrvSW000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 09:59:53 localhost.localdomain influxd[16778]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied
Oct 17 09:59:53 localhost.localdomain influxd[16778]: --bolt-path string                                              path to boltdb database (default "/home/influxdb/.influxdbv2/influxd.bolt")
Oct 17 09:59:53 localhost.localdomain influxd[16778]: --engine-path string                                            path to persistent engine files (default "/home/influxdb/.influxdbv2/engine")
Oct 17 09:59:53 localhost.localdomain systemd[1]: influxdb.service: main process exited, code=exited, status=1/FAILURE
Oct 17 09:59:53 localhost.localdomain systemd[1]: Unit influxdb.service entered failed state.
Oct 17 09:59:53 localhost.localdomain systemd[1]: influxdb.service failed.
Oct 17 09:59:53 localhost.localdomain systemd[1]: influxdb.service holdoff time over, scheduling restart.
Oct 17 10:00:07 localhost.localdomain influxd[16795]: ts=2020-10-17T10:00:07.316899Z lvl=error msg="Failed opening bolt" log_id=0PuVsma0000 error="unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied"
Oct 17 10:00:07 localhost.localdomain influxd[16795]: Error: unable to create directory /home/influxdb/.influxdbv2/influxd.bolt: mkdir /home/influxdb: permission denied

根據上面的日誌，創建文件夾失敗。我執行了這個：sudo mkhomedir_helper influxdb創建主文件夾influxdb，檢查權限的結果是這樣的：

[vagrant@localhost ~]$ sudo ls -l /home
total 0
drwxr-xr-x. 4 influxdb influxdb  95 Oct 17 11:39 influxdb
drwx------. 4 vagrant  vagrant  109 Oct 17 11:54 vagrant

我無法弄清楚我缺少給使用者（創建的：）足夠的權限以sudo useradd -rs /bin/false influxdb將二進製文件作為服務執行？

更新：添加了審核日誌

type=SERVICE_START msg=audit(1602934669.699:3137): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934683.369:3138): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934683.556:3139): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934683.556:3140): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934683.558:3141): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934697.637:3142): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934697.879:3143): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934697.879:3144): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934697.882:3145): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934711.388:3146): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934711.561:3147): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934711.561:3148): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934711.565:3149): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934725.261:3158): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934725.700:3159): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934725.700:3160): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934725.700:3161): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934739.450:3162): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934739.558:3163): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934739.559:3164): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934739.561:3165): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934753.257:3166): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1602934753.585:3167): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934753.585:3168): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934753.588:3169): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1602934783.087:3186): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1602934794.151:3193): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=influxdb comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=USER_AUTH msg=audit(1602937018.434:3233): pid=13575 uid=1000 auid=1000 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=? acct="influxdb" exe="/usr/bin/su" hostname=localhost.localdomain addr=? terminal=pts/0 res=failed'
type=USER_CHAUTHTOK msg=audit(1602937096.193:3238): pid=13581 uid=0 auid=1000 ses=7 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=PAM:chauthtok grantors=? acct="influxdb" exe="/usr/bin/passwd" hostname=localhost.localdomain addr=? terminal=pts/0 res=failed'

幫助？謝謝

直到昨天我遇到一個類似的問題並將其追溯到 SELinux 時，我才確定這個問題。

InfluxDB 沒有 SELinux 策略，Red Hat 既不提供也不包含在 InfluxDB 本身中。此類服務在通用策略下執行，除其他外，該策略禁止服務訪問/home，因為系統服務應將其文件放置在其他地方。

嘗試將 InfluxDB 主目錄/home/influxdb從/var/lib/influxdb. 你可以這樣做：

1. 執行sudo mv /home/influxdb /var/lib/influxdb以移動文件。
2. 執行sudo restorecon -rv /var/lib/influxdb以修復 SELinux 上下文。
3. 執行sudo vipw以編輯 passwd 文件，並將 influx 使用者的主目錄從/home/influxdb更改為/var/lib/influxdb.

現在嘗試再次啟動服務。如果它不起作用，您可能還需要重新執行influx setup以擺脫任何引用/home.

引用自：https://serverfault.com/questions/1039085