When calling sane-scan-pdf from scanbd, it is run with euid root, causing permission errors

[kleinarne]

I'm still trying to get sane-scan-pdf to work with scanbd. After solving some configuration issues, I am now stuck.

In the debian bugtracker, there is an unresolved bug from 2016 that seems to describe my problem fairly well:

when configuring user = saned in the global section of scanbd.conf, scanbd itself is running as user saned, but the effective UID remains root. This leads to the situation that any scripts that are executed by scanbd, will act as user root. The expected result is, that the effective UID is set to saned as well.

This seem to be the root of the permissions issues I [1] and others [2] have been facing.

After working around the units issue by adding --no-default-size [3], I got very similar issues later in post processing with parallel: parallel: Error: Cannot change into non-executable dir /root/.parallel: Permission denied.

As described in the bug report quoted above, I configured scanbd to drop its privileges to user saned (114) and group scanner (110). On startup of sanebd, I do get the following output which looks promising:

scanbd: drop privileges to gid: 114
scanbd: Running as effective gid 114
scanbd: drop privileges to uid: 110
scanbd: Running as effective uid 110

However, when pressing the scan button, no matter what I set scanbd.conf's user setting to, scanbd always outputs scanbd: setting env: USER=root and scanbd: setting env: HOME=/root when scanning, despite the debug output at startup, which seems to be in line with the quoted sanebd bug report (see debug log at the end).

In the shim script that calls sane-scan-pdf, I added a line HOME=/home/username which got me past the parallel: Error: Cannot change into non-executable dir /root/.parallel: Permission denied error, but then caused all sorts of other issues until I exited the shell, so I guess that's not really a good idea either.

Do you have any idea how to solve this? I wonder how @nyn44e got it to work?

scanbd: value trigger: numerical
scanbd: trigger action for scan for device epjitsu:libusb:001:005 with script epjitsu.script
scanbd: get_sane_option_value
scanbd: Value of mode as string (len 7, hash -621353420): Lineart
scanbd: setting env: SCANBD_FUNCTION_MODE=Lineart
scanbd: setting env: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
scanbd: No PWD, setting env: PWD=/home/username
scanbd: setting env: USER=root
scanbd: setting env: HOME=/root
scanbd: setting env: SCANBD_DEVICE=epjitsu:libusb:001:005
scanbd: setting env: SCANBD_ACTION=scan
scanbd: append string epjitsu:libusb:001:005 to signal scan_begin
scanbd: now sending signal scan_begin
scanbd: append string SCANBD_FUNCTION_MODE=Lineart to signal trigger
scanbd: append string PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin to signal trigger
scanbd: append string PWD=/home/user to signal trigger
scanbd: append string USER=root to signal trigger
scanbd: append string HOME=/root to signal trigger
scanbd: append string SCANBD_DEVICE=epjitsu:libusb:001:005 to signal trigger
scanbd: append string SCANBD_ACTION=scan to signal trigger
scanbd: now sending signal trigger
scanbd: now flushing the dbus
scanbd: unref the signal
scanbd: using relative script path: epjitsu.script, expanded to: /home/username/scanbd-scripts/epjitsu.script
scanbd: waiting for child: /home/username/scanbd-scripts/epjitsu.script
scanbd: setgid to gid=114
scanbd: setuid to uid=1000
scanbd: exec for /home/username/scanbd-scripts/epjitsu.script
scanbd: octal mode for /home/username/scanbd-scripts/epjitsu.script: 100755
scanbd: file uid: 1000, file gid: 1000
Scanning...
Scanned document /tmp/scan.H396FvHBB3/scan-0001
Scanned document /tmp/scan.H396FvHBB3/scan-0002
scan_perpage: 
scan_perpage: -------------------------------------------------------------------------------
scan_perpage: Post-processing scanned page /tmp/scan.H396FvHBB3/scan-0001, deskew=0, searchable=0, skip-empty-pages=1, white-threshold=99.8, brightness-contrast-sw=...
scan_perpage: -------------------------------------------------------------------------------
Scanned 2 pages
scan_perpage: /tmp/scan.H396FvHBB3/scan-0001 has 95.2695 % white
scan_perpage: Converting image data to pdf...
scan_perpage: ...Running pnmtops on /tmp/scan.H396FvHBB3/scan-0001 using page options: -equalpixels -dpi=300 -noturn
parallel: Error: Cannot change into non-executable dir /root/.parallel: Permission denied
scan_perpage: ...Running ps2pdf on /tmp/scan.H396FvHBB3/scan-0001.ps
parallel: Error: Cannot change into non-executable dir /root/.parallel: Permission denied

[rocketraman]

Given this isn't really an issue with sane-scan-pdf, but rather a scanbd configuration problem, I've converted this into a discussion. Hopefully scanbd users can help each other out here, and if we can figure out the right way to set this up, we can update the README and/or the wiki.

[nalpo]

I've got a similar problem atm: Calling
/home/pi/sane-scan-pdf/scan -d -r 300 -v -m Lineart --skip-empty-pages -o /home/pi/scans/scan-now.pdf starts the scan, but gives
an error:
/home/pi/sane-scan-pdf/scan_perpage: line 45: time: command not found

Using scanbd and pushing the button on my scanner (Fujitsu ScanSnap S1500) leads to this:

● scanbd.service - Scanner button polling Service
     Loaded: loaded (/lib/systemd/system/scanbd.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2022-11-01 17:22:14 GMT; 34min ago
   Main PID: 334 (scanbd)
      Tasks: 5 (limit: 1596)
        CPU: 3.611s
     CGroup: /system.slice/scanbd.service
             └─334 /usr/sbin/scanbd -f -c /etc/scanbd/scanbd.conf

Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: trigger action for scan for device fujitsu:ScanSnap S1500:66438 with script scan.sh
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: trigger action for scan for device fujitsu:ScanSnap S1500:66438 with script scan.sh
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: trigger action for page-loaded for device fujitsu:ScanSnap S1500:66438 with script (null)
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: trigger action for scan for device fujitsu:ScanSnap S1500:66438 with script scan.sh
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: trigger action for scan for device fujitsu:ScanSnap S1500:66438 with script scan.sh
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: trigger action for scan for device fujitsu:ScanSnap S1500:66438 with script scan.sh
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: trigger action for page-loaded for device fujitsu:ScanSnap S1500:66438 with script (null)
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: trigger action for scan for device fujitsu:ScanSnap S1500:66438 with script scan.sh
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: access: Permission denied
Nov 01 17:50:18 raspberrypi scanbd[4214]: /usr/sbin/scanbd: execlp: Permission denied

In the beginning, I had more permission denied entries, which could be solved by changing the owner of /etc/scanbd/scripts.
@kleinarne, could you find a solution?

[nalpo]

Well whatever it was, starting today lead me back to "no SANE devices found". I think 'i'll shelve this topic for another time since right now none of the solutions/tutorials I saw worked unfortunately.

[kleinarne]

@nalpo, I actually did the same, since the problem lies with that bug in scanbd which is not maintained anymore.

I ran into all sorts of problems, most of which I eventually solved, but between the complexity of setting up scanbd and the euid/egid bug that I couldn't resolve I gave up.

Sorry I can't be of more help.

[rocketraman]

Not sure if this link helps anybody: https://superuser.com/questions/1043092/sane-scanning-scanbd-buttons-and-service-permissions

[kleinarne]

I followed that explanation to finally get scanbd to call sane-scan-pdf using the scan button. It helped a great deal solve various config issues, but that only got me into the euid/egid issues discussed here.

It might be possible to set everything up to run as root (run scanbd as root, change the config to run as root, then sane-scan-pdf will run as root too and not have permission issues with the programs it calls.

[kleinarne]

@nalpo, I actually got it working as root.

The last few lines of this post may help with the no SANE devices found issue.

To resolve missing dependencies, see if the following apt installs will show anything missing:

On a fresh install of Raspberry Pi OS, I installed sane, git, and Scan Button Daemon:

sudo apt install sane sane-utils scanbd git

Then I also installed sane-scan-pdf dependencies:

sudo apt install netpbm ghostscript poppler-utils imagemagick unpaper util-linux tesseract-ocr parallel units bc

Check that your sane configs are correct. The client sane first: (as per the superuser.com link posted by rocketraman - the sane config located in /etc/sane.d/) to use only the net backend:

sudo nano /etc/sane.d/dll.conf

net

(dll.conf must not contain anything else!)

...and that the net backend is configured properly:

sudo nano /etc/sane.d/net.conf

connect_timeout 3
localhost

For me, the crucial part was changing the scanbd.conf:

sudo  nano /etc/scanbd/scanbd.conf

user = root
group = root

And then for debugging, stopping the scanbd service:

sudo systemctl stop scanbd.service

...and running scanbd manually as root:

sudo SANE_CONFIG_DIR=/etc/scanbd scanbd -d7 -f

Press the button. For me it actually worked, showing me stats of the postprocessing steps before returning to polling.

Cancel the manually run scanbd, and start the daemon again:

sudo systemctl start scanbd.service

That did it for me, at least scanning using the button works now. I'm still unable to get anything from scanadf -L while the daemon is running, which is probably a configuration error somewhere since scanbd is supposed to handle frontend access while polling the scanner button. I'll look into this at a later point.

This may be where your no SANE devices found issue is coming from too - try stopping the scanbd service first with sudo systemctl stop scanbd and try again. Don't forget to start the service again afterwards!

[fugazzy]

Hello, I got very far to get my fujitsu ix1500 running with sane and scanbd by paperload.
My script gets started but I have an issue with setuid:
scanbd: Can't seteuid root: Operation not permitted
What can I do to make that work?

scanbd: checking option scan number 91 (0) for device fujitsu:ScanSnap iX1500:74644: value: -1649422160 scanbd: get_sane_option_value scanbd: checking option page-loaded number 84 (1) for device fujitsu:ScanSnap iX1500:74644: value: -164942216 0 scanbd: value trigger: numerical scanbd: trigger action for page-loaded for device fujitsu:ScanSnap iX1500:74644 with script /home/pi/sane-sca n-pdf/scan.sh scanbd: get_sane_option_value scanbd: Value of mode as string (len 7, hash -621353420): Lineart scanbd: setting env: SCANBD_FUNCTION_MODE=Lineart scanbd: get_sane_option_value scanbd: setting env: SCANBD_FUNCTION=0 scanbd: setting env: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/ games scanbd: setting env: PWD=/home/pi scanbd: setting env: USER=pi scanbd: setting env: HOME=/home/pi scanbd: setting env: SCANBD_DEVICE=fujitsu:ScanSnap iX1500:74644 scanbd: setting env: SCANBD_ACTION=pageload scanbd: append string fujitsu:ScanSnap iX1500:74644 to signal scan_begin scanbd: now sending signal scan_begin scanbd: append string SCANBD_FUNCTION_MODE=Lineart to signal trigger scanbd: append string SCANBD_FUNCTION=0 to signal trigger scanbd: append string PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr /games to signal trigger scanbd: append string PWD=/home/pi to signal trigger scanbd: append string USER=pi to signal trigger scanbd: append string HOME=/home/pi to signal trigger scanbd: append string SCANBD_DEVICE=fujitsu:ScanSnap iX1500:74644 to signal trigger scanbd: append string SCANBD_ACTION=pageload to signal trigger scanbd: now sending signal trigger scanbd: now flushing the dbus scanbd: unref the signal scanbd: using absolute script path: /home/pi/sane-scan-pdf/scan.sh scanbd: Can't seteuid root: Operation not permitted ce fujitsu:ScanSnap iX1500:74644: value: -1649422160 scanbd: get_sane_option_value scanbd: checking option power-save number 88 (6) for device fujitsu:ScanSnap iX1500:74644: value: -1649422160 scanbd: polling thread for fujitsu:ScanSnap iX1500:74644, before cancellation point scanbd: polling thread for fujitsu:ScanSnap iX1500:74644, after cancellation point scanbd: polling device fujitsu:ScanSnap iX1500:74644 scanbd: get_sane_option_value scanbd: checking option scan number 91 (0) for device fujitsu:ScanSnap iX1500:74644: value: -1649422160 scanbd: get_sane_option_value scanbd: checking option page-loaded number 84 (1) for device fujitsu:ScanSnap iX1500:74644: value: -164942216 0 s

[fugazzy]

On the weekend I got it working (after a complete reinstal) on my raspberrypi 3B and Raspian light 12 bookworm: I copied the script also to /etc/scanbd/scripts/ and set them to "chown saned:scanner *".
I also corrected this: permission bug
That's how I got past the permission errors.
Then I configured an action on paperloaded, as my fujitsu ix1500 has no buttons.
Now ist recognizes a new Paper an starts the scan automatically.