Installing global package with sudo yields permissions error during postinstall routine

Question

I am trying to run this command on CircleCI:

 sudo npm install -g --loglevel=warn @oresoftware/r2g

I get this error:

#!/bin/bash -eo pipefail
sudo npm install -g --loglevel=warn @oresoftware/r2g
/usr/local/bin/r2g -> /usr/local/lib/node_modules/@oresoftware/r2g/cli/r2g.sh
/usr/local/bin/r2g_run -> /usr/local/lib/node_modules/@oresoftware/r2g/cli/r2g_run.sh
/usr/local/bin/r2g_copy_smoke_tester -> /usr/local/lib/node_modules/@oresoftware/r2g/assets/copy_smoke_tester.sh

> @oresoftware/r2g@0.0.132 postinstall /usr/local/lib/node_modules/@oresoftware/r2g
> ./assets/postinstall.sh

mkdir: cannot create directory ‘/root’: Permission denied
could not create directory => '/root/.r2g/temp/project'...
mkdir: cannot create directory ‘/root’: Permission denied
could not create oresoftware/bash dir.
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! @oresoftware/r2g@0.0.132 postinstall: `./assets/postinstall.sh`
npm ERR! Exit status 1
npm ERR! 
npm ERR! Failed at the @oresoftware/r2g@0.0.132 postinstall script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2018-06-17T04_41_24_461Z-debug.log
Exited with code 1

This problem is not particular to CircleCI - this happens in Docker or wherever the wrong permissions are setup.

My question is - if I am the root user - where my $HOME is /root, why would I get a permissions error, when I run:

mkdir -p /root/.r2g/temp/project

As you can see, it failed at the very first dir - I cannot create /root . Even though it already exists, almost certainly, and I should be the root user, where /root is my $HOME dir.

Does anyone know if there is a fix for this on Linux systems? Is there some command I can run to get permissions to my own home directory as root?

I am trying to find a solution that is generic and not forceful.

I tried running this before the npm install command:

sudo chown -R $(whoami) $HOME

That didn't do anything, same error.

A simple 2-line Dockerfile will yield this same exact issue:

FROM node:10
RUN npm install -g @oresoftware/r2g

and it also fails with the same error for this 3-line Dockerfile:

FROM node:10
RUN apt-get update && apt-get install -y sudo
RUN sudo npm install -g @oresoftware/r2g

Here is the postinstall.sh script .

I have cross-posted this question to the CircleCI help forum.

Answer 1

It seems that npm install does a setuid and setgid to nobody. So basically before it runs the postinstall script it changes the user to nobody - a user which of course has no rights to write to /root.

To prevent this you can set the --unsafe-perm flag to true :

npm install --unsafe-perm=true -g @oresoftware/r2g

After that it worked with the docker-example.