Linux, 1password and chezmoi binary/directory ownership

[gunzy83]

Hi,

I was not sure where to raise this but I have run into a weird issue when trying to use chezmoi with 1password on Linux (I am unsure if this is specific to using the Biometric Auth setting, which triggers polkit). I think I have solved the issue and I want to add a warning into the documentation so that others will not get caught by the unhelpful error messages from the CLI.

First some system info:

chezmoi doctor
RESULT    CHECK                MESSAGE
ok        version              v2.22.1, commit 64b9c1fa7346526c17d5073827fe055dc46f6c09, built at 2022-09-03T11:57:36Z, built by Homebrew
ok        latest-version       v2.22.1
ok        os-arch              linux/amd64 (Manjaro Linux)
ok        uname                Linux PF3RDKWV 5.15.60-1-MANJARO #1 SMP PREEMPT Thu Aug 11 13:14:05 UTC 2022 x86_64 GNU/Linux
ok        go-version           go1.19 (gc)
ok        executable           /home/linuxbrew/.linuxbrew/Cellar/chezmoi/2.22.1/bin/chezmoi
ok        upgrade-method       brew-upgrade
ok        config-file          ~/.config/chezmoi/chezmoi.yml, last modified 2022-09-13T10:47:53+10:00
warning   source-dir           ~/.local/share/chezmoi is a git working tree (dirty)
warning   suspicious-entries   ~/.local/share/chezmoi/.chezmoi.yml.tmpl
warning   working-tree         ~/.local/share/chezmoi is a git working tree (dirty)
ok        dest-dir             ~ is a directory
ok        shell-command        found /bin/zsh
ok        shell-args           /bin/zsh
ok        cd-command           found /bin/zsh
ok        cd-args              /bin/zsh
ok        edit-command         found /usr/bin/vim
ok        edit-args            /usr/bin/vim
info      diff-command         not set
ok        umask                022
ok        git-command          found /usr/bin/git, version 2.37.2
ok        merge-command        found /usr/bin/vimdiff
info      age-command          age not found in $PATH
ok        gpg-command          found /usr/bin/gpg, version 2.2.36
info      pinentry-command     not set
ok        1password-command    found /usr/bin/op, version 2.7.0
info      bitwarden-command    bw not found in $PATH
info      gopass-command       gopass not found in $PATH
info      keepassxc-command    keepassxc-cli not found in $PATH
info      keeper-command       keeper not found in $PATH
info      keepassxc-db         not set
info      lastpass-command     lpass not found in $PATH
info      pass-command         pass not found in $PATH
ok        vault-command        found /home/linuxbrew/.linuxbrew/bin/vault, version 1.11.0
info      secret-command       not set

I started with a very simple template to drop a public key into ~/.ssh/ that looks like this:

{{ onepasswordRead "op://Private/test-key/public_key" "my.1password.com" }}

[ERROR] 2022/09/13 08:27:43 could not read secret op://Private/test-key/public_key: error initializing client: connecting to desktop app: read: connection reset, make sure the CLI is correctly installed and CLI Biometric Unlock is enabled in the 1Password app

The rest of the error is incidental and changes depending on whether the prompt setting is true or false.

I initially thought it might be a polkit problem so I went to turn off biometric unlock in the app so I could try signing in manually (to isolate things). Ran the same test command and got the following error:

[ERROR] 2022/09/13 09:50:17 could not read secret op://Private/test-key/public_key: error initializing client: connecting to desktop app: read: connection reset, make sure the CLI is correctly installed and CLI Biometric Unlock is enabled in the 1Password app

It was indeed communicating with the desktop app it seems (and the desktop app controls the polkit prompts?), maybe the desktop app was denying the connection for some reason. I restarted the desktop app in a terminal to see the output.

The first warning and error:

WARN  2022-09-13T09:52:36.310 tokio-runtime-worker(ThreadId(7)) [1P:foundation/op-sys-info/src/process_information/linux.rs:247] binary permission verification failed for /home/linuxbrew/.linuxbrew/Cellar/chezmoi/2.22.1/bin/chezmoi
ERROR 2022-09-13T09:52:36.310 tokio-runtime-worker(ThreadId(7)) [1P:native-messaging/op-native-core-integration/src/lib.rs:477] Failed to accept new connection.: PipeAuthError(UnknownPeer(BinaryPermissions))

I tried copying the binary to a local bin location and changing the permissions:

WARN  2022-09-13T10:01:39.387 tokio-runtime-worker(ThreadId(8)) [1P:foundation/op-sys-info/src/process_information/linux.rs:247] binary permission verification failed for /home/$USER/.bin/chezmoi
ERROR 2022-09-13T10:01:39.387 tokio-runtime-worker(ThreadId(8)) [1P:native-messaging/op-native-core-integration/src/lib.rs:477] Failed to accept new connection.: PipeAuthError(UnknownPeer(BinaryPermissions))

It really is not liking that chezmoi binary.

Once set to owner root:root, the error message changed again:

WARN  2022-09-13T10:20:54.408 tokio-runtime-worker(ThreadId(8)) [1P:foundation/op-sys-info/src/process_information/linux.rs:247] binary permission verification failed for /home/$USER/.bin
ERROR 2022-09-13T10:20:54.408 tokio-runtime-worker(ThreadId(8)) [1P:native-messaging/op-native-core-integration/src/lib.rs:477] Failed to accept new connection.: PipeAuthError(UnknownPeer(BinaryPermissions))

So now the directory is not permitted, so I tried moving the binary to /usr/bin/chezmoi:

/usr/bin/chezmoi execute-template '{{ onepasswordRead "op://Private/test-key/public_key" "my.1password.com" }}'
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxerpYFsUuLCpRwpcCAnSabbtEYeQb83Wq4efgjF43z

Success!

Now I have two questions:

• Is this a known issue?
• Where is the best place in the documentation to put a warning about this?

I think installing chezmoi using a system package needs to be recommended for using 1password (at least with biometric login). I have now installed the Arch Linux package on this machine and it is working properly.

[twpayne]

Thanks for reporting this - this is a new issue.

The best place for documenting this is the 1Password section of the user guide and the reference manual, namely https://github.com/twpayne/chezmoi/blob/v2.22.1/assets/chezmoi.io/docs/user-guide/password-managers/1password.md and https://github.com/twpayne/chezmoi/blob/v2.22.1/assets/chezmoi.io/docs/reference/templates/1password-functions/index.md.

Note that the onepassword.prompt option might get removed, see #1974 for the gory details.

[gunzy83]

Awesome, thanks for the fast response. I will find some time before the weekend to raise a PR.

I had read #1974 which was what gave me the idea of using onepassword.prompt in the debugging process. With Biometric unlock the issues around environment variables mentioned in that thread are a non-issue. However, when onepassword.prompt is true (the default), it results in getting prompted for each and every template function that is called if you have multiple accounts logged in. I only discovered this first thing this morning on my work machine that has a personal and business account logged in and it was only 3 templates so far (still irritating) but it kind of defeats the purpose of the automation if I have to site there and watch the apply.

I might chime in over in #1974.

Thanks again, and thanks for making chezmoi!

[gunzy83]

After further testing it seems that once both accounts are authorised in the shell session it stops prompting you for the rest of the chezmoi apply run (only once). I will still chime in because ideally if the account that is specified in the template is logged in it should continue without prompting.