How to make application work without Root-previlages?

[lbRaytec]

I am working with Axis camera where our plugin can be installed within Axis camera. Our plugin is already signed by Axis ACAP and thus it will work with Axis os 12 as well. However, our application uses root - previlages to be installed within Axis. In order to remove that I changed in the manifest file related to user and group, I set that empty. I was able to install our plugin but our plugin goes unsigned and does not work either!

[github-actions[bot]]

This automatically generated reply acts as a friendly reminder.

Answers to your questions will most often come from the community, from developers like yourself. You will, from time to time, find that Axis employees answers some of the questions, but this is not a guarantee. Think of the discussion forum as a complement to other support channels, not a replacement to any of them.

If your question remains unanswered for a period of time, please revisit it to see whether it can be improved by following the guidelines listed in Axis support guidelines.

[vivekatoffice]

Hi @lbRaytec ,
I suggest you refer to the docker-acap : First release of rootless Docker ACAP!

This may give you an idea about the changes in manifest.json

Snapshot of code diff from 2.0.0 and 3.0.0

Once you build a new rootless ACAP you can sign the ACAP again using ACAP Service Portal

[lbRaytec]

Thank you for your response. I could see that if the user needs a secondary group, it can be specified under resources according to the documentation here.

I do not need secondary group. Also, I do not want to move to the schemaVersion to 1.7.0

Is it possible to make plugin rootless within schema 1.3.0 and also how to make it to dynamic user? Based on the link above, I just removed "user": {"group": "root", "username": "root"} from the manifest file. I was able to install my plugin as rootless but for some reason the plugin didn't work. I am getting 500 Internal server error because of the removal of user and group. I am quite new working with axis plugin. I referred axis-sdk example "web-server" with monkey-server.

[vivekatoffice]

Hi @lbRaytec ,
I tried web-server with the following manifest.json:

{
	"schemaVersion": "1.3",
	"resources": {
        "linux": {
            "user": {
                "groups": ["sdk", "storage"]
            }
        }
    },
	"acapPackageConf": {
		"setup": {
			"appName": "list",
			"vendor": "Axis Communications",
			"embeddedSdkVersion": "3.0",
			"runMode": "never",
			"version": "1.0.0"
		}
	}
}

root-less application:

Output:

I am not sure what your application is trying to do but if possible you can upload the camera server report to AXIS Server Report Viewer to check for the error message.

[lbRaytec]

Thanks for your response. Sure, I will get the log and post it here, but before I will give you some heads up on what I am trying to build. The example that you have mentioned actually gets executed on a separate port (2001). What I am trying to work is when I install the plugin I get an open button and upon pressing that, the browser directs it to my plugin in a new tab. For instance, the plugin URL will look something like this: "http://<camera_Ip>/local/<plugin_name>/index.html". The problem is when I load the index.html page, I get 500 Internal server.

To add more detail to the error, I will post the logs here!

Also, what about package.conf file? there is a

APPGRP="root"
APPUSR="root"

in package.conf file. Should I remove this?

[vivekatoffice]

Hi @lbRaytec ,
Thank you for explaining what you need to do in ACAP.

I used following manifest.json to host HTML pages from here

{
    "schemaVersion": "1.3",
    "acapPackageConf": {
        "setup": {
            "appName": "hello_world",
            "vendor": "Axis Communications",
            "version": "1.0.0",
            "runMode": "never",
            "embeddedSdkVersion": "3.0"
        },
        "configuration": {
            "settingPage": "index.html"
        }
    }
}

Just used the hello-world example and added the html folder.

HTML(index.html) code from here in case if you need to recreate the example which I have tested.

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Clock and Date</title>
    <style>
        .clockdate-wrapper {
            background-color: #333;
            padding: 25px;
            max-width: 350px;
            width: 100%;
            text-align: center;
            border-radius: 5px;
            margin: 0 auto;
        }
        #clock {
            background-color: #333;
            font-family: sans-serif;
            font-size: 60px;
            text-shadow: 0px 0px 1px #fff;
            color: #fff;
        }
        #clock span {
            color: #888;
            text-shadow: 0px 0px 1px #333;
            font-size: 50px;
            position: relative;
            top: -5px;
            left: 10px;
        }
        #date {
            letter-spacing: 3px;
            font-size: 14px;
            font-family: arial, sans-serif;
            color: #fff;
        }
    </style>
</head>
<body onload="startTime()">
    <div id="clockdate">
        <div class="clockdate-wrapper">
            <div id="clock"></div>
            <div id="date"></div>
        </div>
    </div>
    <script>
        function startTime() {
            var today = new Date();
            var hr = today.getHours();
            var min = today.getMinutes();
            var sec = today.getSeconds();
            var ap = (hr < 12) ? "<span>AM</span>" : "<span>PM</span>";
            hr = (hr == 0) ? 12 : hr;
            hr = (hr > 12) ? hr - 12 : hr;
            hr = checkTime(hr);
            min = checkTime(min);
            sec = checkTime(sec);
            document.getElementById("clock").innerHTML = hr + ":" + min + ":" + sec + " " + ap;

            var months = ['January', 'February', 'March', 'April', 'May', 'June', 'July', 'August', 'September', 'October', 'November', 'December'];
            var days = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
            var curWeekDay = days[today.getDay()];
            var curDay = today.getDate();
            var curMonth = months[today.getMonth()];
            var curYear = today.getFullYear();
            var date = curWeekDay + ", " + curDay + " " + curMonth + " " + curYear;
            document.getElementById("date").innerHTML = date;

            setTimeout(startTime, 500);
        }

        function checkTime(i) {
            if (i < 10) {
                i = "0" + i;
            }
            return i;
        }
    </script>
</body>
</html>

Another best example you can follow as per my understanding:

opc-ua-colorchecker-acap

Regarding "package.conf": It is replaced by manifest.json

Read more: What’s new in release 3.3.0

[lbRaytec]

Also, just got into TIP. Will be signing the application and see how it goes!

[lbRaytec]

Hi, I signed my package with Axis and still I am facing the 500 Internal server error! Will do more work arounds and will try to identify what's causing. Just to let you know, removing the user and group as root gets me here. Adding them back in the manifest solves the problem but in that case my plugin will depend on root privilege which I am trying to eliminate.

[vivekatoffice]

Hi @lbRaytec ,
I am not so sure about the 500 Internal server error but do try with group [sdk] if possible:
Snapshot from /docker-acap/blob/main/app/manifest.json:

[lbRaytec]

A doubt, might be very basic. What's the role of access here? I could see that we can set "access" to "admin", "operator", "viewer". what do you suggest for a dynamic user? "admin" or "operator"?

[daniel-falk]

@lbRaytec The "admin", "operator", "viewer" only controls which web users can access the web site, i.e. should someone logged in as a "viewer" be able to access the config page in your ACAP? These are not at all related to the backend user, that decides what your application is allowed to do.

[daniel-falk]

Hi @lbRaytec , most likely is that some logic in your application is trying to do something it is not allowed to as the less privileged user. There are two ways you can get a 500 error from the application when using transferCgi. Either the handler function is not working, this could be because the ax_http_handler_new was never called, or because your application segfaulted in the handler function. In this case you should see a 500 error with the text "The server encountered an error and could not complete your request". The other option is that your application did handle an error and manually wrote a Status: 500 to the GOutputStream.

To find a segfault, the easiest way is to use the GDB debugger. But logging to the systemlog can also help you. This is most likely due to your code not checking return codes for success/failure (for e.g. Posix commands dealing with the filesystem).

I have verified that the transferCgi works with a dynamic user. I did this in SDK 3.5 and with this manifest:

{
    "schemaVersion": "1.1",
    "acapPackageConf": {
        "setup": {
            "friendlyName": "LegacyWeb AxHTTP",
            "appName": "LegacyWeb",
            "vendor": "FixedIT Consulting AB",
            "embeddedSdkVersion": "2.18",
            "vendorUrl": "fixedit.ai",
            "runMode": "never",
            "version": "0.0.1"
        },
        "configuration": {
            "settingPage": "settings",
            "httpConfig": [
                    {"access": "admin","name": "settings","type": "transferCgi"}
            ]
        }
    }
}

[daniel-falk]

Hi @lbRaytec ,

There are a few things that looks a bit odd with your logs.

The first is that in your log it seems like you are using the monkey web server. This would explain why your application fails with 500 error, using monkey with non-privileged users needs to be done with the new reverse proxy config instead of manual installation in the postinstall script that was common before. The strange thing is that your manifest.json file looks like if you are using the transferCgi with axhttp which should not be used together with the monkey web server. Can you share your postinstall script and the part of the code in your application where you handle web requests?

These logs sound like a legacy postinstall script to use the monkey webserver:

systemctl[23347]: Failed to reload httpd.service: Access denied
[ ERR     ] systemctl[23347]: See system logs and 'systemctl status httpd.service' for details.

These log messages indicate that you use the monkey web server:

raytecint[23346]: mklib_init success
raytecint[23346]: mklib_config success
raytecint[23346]: mklib_start success

The second thing is that in the log it looks like your application fails to open its files. This can happen if they remain owned by root as they were before, but when you reinstall the application with the new low-privileged user, the ACAP framework should change the ownership of the files. Can you SSH to the camera and do an ls -lah in /usr/local/packages/raytecint/ and /usr/local/packages/raytecint/localdata/?

raytecint[23346]: Failed to create folder: /usr/local/packages/raytecint/
raytecint[23346]: Created Folder: /usr/local/packages/raytecint/
raytecint[23346]: Loading from file /usr/local/packages/raytecint/localdata/lamps.rad
raytecint[23346]: Failed to read data from lamp configuration file.
raytecint[23346]: Failed to read data from lamp group configuration file.
raytecint[23346]: Loading from file /usr/local/packages/raytecint/localdata/lampgroups.rad
raytecint[23346]: Failed to read data from event action configuration file.

[lbRaytec]

Hi, Now I am getting a 403: Forbidden error. I think I have pretty much troubleshooted and cleared 500 server error I suppose, not sure how it goes from here.

[lbRaytec]

Also, I have checked with Postman. I am getting positive response for "http://<camera_ip>/local/<plugin_name>/getconfig.cgi". No more 500 here which I was getting previously. But, now I am getting 403 at index.html which is not loading.

[lbRaytec]

Hi! I had used postinstall.sh script to handle reverse proxy so that whatever the request that hits "/local/raytecint/" will be redirected to localhost:2001. previously in my manifest.json file i had mentioned postinstall.sh script and then later I found out it's been taken care in the code itself. So, when I removed the line from manifest file, I am able to hit the request without getting the 500 error. As you can see the same request responds with 200 in the postman.

But, I am not sure why it throws 403 forbidden. I believe somewhere something is blocking the url. Not sure if monkey server or anything.

ssh into the url provides the following:

[lbRaytec]

1. Our Plugin rely on root user for the raytecint ACAP application. When the application is opened, the application is hosted on a port through monkey server. Some common port where the application is hosted are http://localhost:2001 or http://localhost:4002 (whichever is available). So when http://<camera_ip>/local/raytecint/index.html hits a request it is proxyed (diverted) to one of the port exposed and the response is forwarded back to client. Doing a curl http://localhost:2001 would give the same response as http://<camera_ip>/local/raytecint/index.html. This confirms the proxy works perfectly.

2. Amidst all this, when the raytec ACAP application is started/stopped, opened/closed, the httpd server is restarted or reloaded. The problem with rootless is, the reload is denied because we are no more in the root user.

3. Why the httpd server is restarted? Because, when the application is started, a script runs that asks the server to proxy the request to the following port (in my case it is 2001 or 4002). A logic is executed when the application is initially started, this logic checks the port the application is hosted and modifies the reverproxy.conf file in the /etc/apache2/conf.d/reverseproxy.conf. As the file is modified, we restart the server again. When we go rootless, this file is not there because this file is created from my ACAP plugin. When the plugin was with root privilege, the user had access to the location and hence the file was created. As the application goes rootless, now dynamic-user does not have access to write in the location.

NOTE: There is another problem here, if user is using our at present plugin which has root privilege and upgrading to new version which is rootless, the reverseproxy.conf file would still be there and opening our application would result in 403 Forbidden error. curl http://localhost:2001 also results the same. Doing a factory reset the Axis camera, the file will no longer be there and opening our application would result in 500 Internal Server Error.

I found this documentation in the Axis portal: Problem: Application can not serve a web page

Tried this in the manifest as well, I got an error in validating the manifest.

Failed validating 'additionalProperties' in schema['properties']['acapPackageConf']['properties']['configuration']:

My Schema version is 1.3 and "embeddedSdkVersion": "3.0". In the docker file, these are the parameters:

ARG ARCH=armv7hf
ARG REPO=axisecp
ARG SDK=acap-native-sdk
ARG UBUNTU_VERSION=20.04
ARG VERSION=1.1

I am not sure, if my schema version must be higher, please suggest me on using this, I could try this as well and see how it goes!