keepalived-sync: rsync.sh mkdir fails with Permission denied due to missing sudo

[willjayyyy]

Environment

• ImmortalWrt 24.10.5 (r33805-7c4e882aaf6f)
• Architecture: x86_64
• Package: keepalived-sync 2.3.1-r1

Problem

In /usr/share/keepalived/scripts/rsync.sh, the mkdir command on the remote peer runs as the keepalived user without sudo, while rsync correctly uses sudo rsync. When the sync target directory (/usr/share/keepalived/rsync/) contains subdirectories owned by root (which is the normal case after sudo rsync -a preserves ownership), the mkdir command fails with:

mkdir: can't create directory '/usr/share/keepalived/rsync/etc/...': Permission denied

Root Cause

In rsync.sh, line ~59:

# Current (broken):
timeout 10 ssh $ssh_options $ssh_remote mkdir -m 755 -p "$dirs_list /tmp" || {

# Should be:
timeout 10 ssh $ssh_options $ssh_remote sudo mkdir -m 755 -p "$dirs_list /tmp" || {

The rsync command already uses sudo via --rsync-path="sudo rsync", but mkdir does not. Since rsync -a preserves source file ownership (root:root), the directories on the receiving peer become root-owned after the first sync. Subsequent syncs then fail at the mkdir step because the keepalived user cannot create subdirectories inside root-owned directories.

Additionally

The sudoers file /etc/sudoers.d/keepalived only grants permission for /usr/bin/rsync:

keepalived ALL= NOPASSWD:/usr/bin/rsync

It should also include /bin/mkdir:

keepalived ALL= NOPASSWD:/usr/bin/rsync,/bin/mkdir

Expected

The mkdir command should use sudo like rsync does, and the sudoers configuration should permit it.

Workaround

# Fix rsync.sh (lost on package upgrade)
sed -i 's|ssh_remote mkdir|ssh_remote sudo mkdir|' /usr/share/keepalived/scripts/rsync.sh

# Fix sudoers (preserved on upgrade)
echo 'keepalived ALL= NOPASSWD:/usr/bin/rsync,/bin/mkdir' > /etc/sudoers.d/keepalived

[brada4]

Youd probably want to make temp files in /tmp/...

[willjayyyy]

The rsync.sh script and sync directory (/usr/share/keepalived/rsync/) are both part of the keepalived-sync package itself, not user-defined:

$ opkg search /usr/share/keepalived/scripts/rsync.sh
keepalived-sync - 2.3.1-r1

The sync directory path is set by the package's default configuration (sync_dir), and rsync -a (with --rsync-path="sudo rsync") preserves root ownership on synced files. So after the first successful sync, subdirectories under /usr/share/keepalived/rsync/ become root-owned, and subsequent mkdir calls by the keepalived user fail.

Since both the script and the directory are managed by the package, the fix should also be in the package — either adding sudo to the mkdir command and updating the sudoers file, or changing the approach as you suggested.

[willjayyyy]

Closing this issue. The mkdir permission issue is a valid problem, but after further review, the workaround (wrapper script + sudoers) is sufficient. Apologies for the noise.

[willjayyyy]

Reopening - this is a confirmed bug in the upstream source code.

In rsync.sh (openwrt-24.10 branch, line 59):

# Line 59 - mkdir without sudo:
timeout 10 ssh $ssh_options $ssh_remote mkdir -m 755 -p "$dirs_list /tmp" || {

# Line 67 - rsync with sudo:
rsync ... --rsync-path="sudo rsync" ...

# Line 83 - rsync with sudo:
rsync ... --rsync-path="sudo rsync" ...

rsync uses sudo but mkdir does not. After the first sync, sudo rsync -a preserves root ownership on directories. Subsequent syncs fail at mkdir because the keepalived user cannot create subdirectories inside root-owned directories.

[brada4]

You can run conditional script,
like

command -v sudo && sudo uname || uname

[willjayyyy]

Thanks for the suggestion. Just to clarify — is this something you plan to fix in the package, or are you suggesting a workaround for users?

The issue is in the package's own rsync.sh script (line 59), and users cannot modify it permanently since it gets overwritten on every package upgrade. A fix in the package itself would be the proper solution.

Also, even with sudo mkdir, the sudoers file (/etc/sudoers.d/keepalived) shipped by the package only permits /usr/bin/rsync, not /bin/mkdir. That would need to be updated as well.

[brada4]

You are the user of it, As for OpenWrt you can patch away sudo, but if you want to submit the fix upstream you can approach sudo conditionally