Take the 2-minute tour ×

I added a new group: ircuser and a new user: ircuser

In visudo I placed this line:

myuser localhost=(ircuser) NOPASSWD: /usr/bin/irssi

Created ircuser directory, where config files, caches, etc should be saved:

drwxrwx--- 2 ircuser ircuser 4096 Mar  2 10:28 ircuser

When issuing the command:

sudo -Hu ircuser /usr/bin/irssi


sudo -u ircuser /usr/bin/irssi

The program can't save the config file in the ircuser directory.

** ERROR **: Couldn't create /home/myuser/_web/ircuser/.irssi directory

But, it is being run as ircuser:

ps auxw | grep irssi
ircuser  11962  0.0  0.0  23684  2504 pts/6    S+   11:18   0:00 /usr/bin/irssi

So, albeit irssi is run by ircuser it can't write to a directory owned by the same user? What do I need to change to allow it saving there?

share|improve this question
Does /home/myuser/_web/ircuser/ exists ? if yes, it belongs to ? –  Coren Mar 2 '12 at 14:35
add comment

3 Answers

up vote 3 down vote accepted

The problem probably lies in not having eXecute permission in one of the parent directories leading up to ircuser's home directory. In order for any user to traverse, not necessarily look into a directory, that user must have execute permission either via a group, or via other. If you have these permissions:

drwxrwx--- 2 myuser myuser 4096 Mar  2 10:28 /home/myuser

And ircuser is not part of the myuser group, then ircuser can't access any file underneath even if it has permissions for that directory. If you try this instead:

drwxrwx--x 2 myuser myuser 4096 Mar  2 10:28 /home/myuser

Then ircuser can't browse myuser's home directory, but it can potentially access some file beneath it such as /home/myuser/_web/ircuser

UPDATE: A few more details I left out from the above description. Permissions are evaluated as you traverse the file system. It's possible to be able to access a folder starting from the current directory that you can't access starting from the root directory. If you change your working directory to somewhere else, you will loose your handle on the current directory and loose access to the files in it. If you use something like sudo su - ircuser, su will switch to the home directory of ircuser before dropping root privileges. At that point, you have a valid handle for ircuser's home directory because it's the current working directory. If you start irssi, it will be running in ircuser's home directory as ircuser. If you try to access .irssi, that will work because you have eXecute permission on the current direcory. If you have to traverse a directory where you are lacking eXecute permission, iy will fail. For example, opening up the file /home/myuser/_web/ircuser/.irssi or even starting from the current directory and using the relative path of ../../_web/ircuser/.irssi because it requires traversing /home/myuser where you have no eXecute permission.

share|improve this answer
That's it! When I changed ircuser to /home the problem was solved. Thank you for the explanation. The only thing I don't understand now is (as I mentioned in a commento to pat) that the program (lynxin that case) appears in ps auxw as being run by ircuser, which is fine, but also by root. Would you mind explaining why does this happen? Is this a security risk? –  Luis Mar 2 '12 at 21:40
@Luis I updated the description to better clarify the problem. –  penguin359 Mar 2 '12 at 22:05
add comment

Use the -H option which makes the command executed with sudo to consider 'home' the user's home directory. You can find more detailed explanation on sudo's man page: http://linux.die.net/man/8/sudo

share|improve this answer
As you can see, it doen't work even when I use -H option. –  Luis Mar 2 '12 at 14:15
What home directory is set for ircuser in /etc/passwd? That's the directory sudo -H will try to use. Also check in /etc/sudoers the values of env_reset, env_keep or always_set_home. –  Patkos Csaba Mar 2 '12 at 14:27
add comment

Would you mind trying with sudo -iu ircuser /usr/bin/irssi ?

Additionally, as Patkos Csaba already stated check for the env_reset, env_keep Defaults set in your sudoers.

From the sudoers manpage:

sudoers will initialize the environment regardless of the value of
env_reset.  The DISPLAY, PATH and TERM variables remain unchanged;
On Linux and AIX systems the contents of /etc/environment are also
included.  All other environment variables are removed.

So sudo -i will initialize the environment getting around the values of these.

Edit: I've reproduced your setup on a Ubuntu box and even sudo -u ircuser /usr/bin/irssi works fine for me.

From my /etc/sudoers

Defaults    env_reset, log_output
testing LABUBU01=(ircuser) NOPASSWD: /usr/bin/irssi


testing@LABUBU01:~$ sudo -V
Sudo version 1.8.3p1
pmplugin policy_plugin 5.6.0 (034)
pmplugin io_plugin 5.6.0 (034)
testing@LABUBU01:~$ uname -a

testing@LABUBU01:~$ ls -lap /home/
total 64
drwxr-xr-x 16 root     root     4096 2012-03-02 15:57 ./
drwxr-xr-x 22 root     root     4096 2011-12-08 15:48 ../
drwxr-xr-x  3 ircuser  ircuser  4096 2012-03-02 15:57 ircuser/



your error:

** ERROR **: Couldn't create /home/myuser/_web/ircuser/.irssi directory aborting... Aborted

states, it cannot create /home/myuser/_web/ircuser/.irssi which is in your home, not in ircuser's home directory. /EDIT2

share|improve this answer
I deleted ircuser and started again, this time not modifying user base directory -b option in adduser. It works now. Thank you both. Problem (?) now is that ps auxw | grep lynx (changed irssi for lynx) gives:root 15461 0.0 0.0 20064 1516 pts/0 S+ 16:52 0:00 sudo -Hu ircuser /usr/bin/lynx ircuser 15462 0.0 0.0 19544 456 pts/2 Ss 16:52 0:00 sudo -Hu ircuser /usr/bin/lynx ircuser 15463 0.0 0.1 22788 5016 pts/2 S+ 16:52 0:00 /usr/bin/lynx ircuser 15464 0.0 0.0 0 0 as you can see a root owned lynx. Is this fine? –  Luis Mar 2 '12 at 16:56
add comment

Your Answer


