start: insufficient permissions to directories

Fixed a bug where an error did not appear when access rights to the var
directive were insufficient.

Closes #1238

Author: r.inyakin

CHANGELOG.md

@@ -13,6 +13,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Fixed
 
+- `tt start`: fixed a bug where an error did not appear when access rights
+  to the var directive were insufficient.
+
 ## [2.11.4] - 2026-03-04
 
 The auxilary release just to keep version matching with `tt-ee`

cli/cmd/start.go

@@ -10,6 +10,7 @@ import (
 	"sync"
 	"syscall"
 
+	"github.com/apex/log"
 	"github.com/spf13/cobra"
 	"github.com/tarantool/tt/cli/cmd/internal"
 	"github.com/tarantool/tt/cli/cmdcontext"
@@ -92,9 +93,12 @@ func startInstancesInteractive(cmdCtx *cmdcontext.CmdCtx, instances []running.In
 		prefix := running.GetAppInstanceName(instCtx) + " "
 		wg.Add(1)
 		go func(inst running.InstanceCtx) {
-			running.RunInstance(ctx, cmdCtx, inst,
+			err := running.RunInstance(ctx, cmdCtx, inst,
 				running.NewColorizedPrefixWriter(os.Stdout, clr, prefix),
 				running.NewColorizedPrefixWriter(os.Stderr, clr, prefix))
+			if err != nil {
+				log.Error(err.Error())
+			}
 			wg.Done()
 		}(instCtx)
 	}

cli/running/running.go

@@ -753,7 +753,12 @@ func RunInstance(ctx context.Context, cmdCtx *cmdcontext.CmdCtx, inst InstanceCt
 ) error {
 	for _, dataDir := range [...]string{inst.WalDir, inst.VinylDir, inst.MemtxDir, inst.RunDir} {
 		if err := util.CreateDirectory(dataDir, defaultDirPerms); err != nil {
-			return err
+			return fmt.Errorf("failed to run instance %q: %s",
+				GetAppInstanceName(inst)+" ", err)
+		}
+		if err := util.IsDirContentWritable(dataDir); err != nil {
+			return fmt.Errorf("failed to run instance %q: %s",
+				GetAppInstanceName(inst)+" ", err)
 		}
 	}
 
@@ -966,6 +971,20 @@ Cluster config path: %q`, tntVersion.Str, inst.ClusterConfigPath)
 func StartWatchdog(cmdCtx *cmdcontext.CmdCtx, ttExecutable string, instance InstanceCtx,
 	args []string,
 ) error {
+	for _, dataDir := range [...]string{
+		instance.WalDir, instance.VinylDir,
+		instance.MemtxDir, instance.RunDir,
+	} {
+		if err := util.CreateDirectory(dataDir, defaultDirPerms); err != nil {
+			return fmt.Errorf("failed to run instance %q: %s",
+				GetAppInstanceName(instance)+" ", err)
+		}
+		if err := util.IsDirContentWritable(dataDir); err != nil {
+			return fmt.Errorf("failed to run instance %q: %s",
+				GetAppInstanceName(instance)+" ", err)
+		}
+	}
+
 	appName := GetAppInstanceName(instance)
 	// If an instance is already running don't try to start it again.
 	// To restart an instance use tt restart command.

cli/util/util.go

@@ -752,6 +752,70 @@ func CreateDirectory(dirName string, fileMode os.FileMode) error {
 	return nil
 }
 
+// IsDirWritable checks if the directory is writable.
+func IsDirWritable(dirName string) error {
+	testFile, err := os.CreateTemp(dirName, ".tt_write_test_*")
+	if err != nil {
+		return fmt.Errorf("directory %q is not writable: %w", dirName, err)
+	}
+
+	defer os.Remove(testFile.Name())
+
+	if err = testFile.Close(); err != nil {
+		return fmt.Errorf("failed to close test file %q: %w", testFile.Name(), err)
+	}
+
+	testWriteFile, err := os.OpenFile(testFile.Name(), os.O_RDWR, 0)
+	if err != nil {
+		return fmt.Errorf("failed to open test file %q: %w", testFile.Name(), err)
+	}
+
+	if err = testWriteFile.Close(); err != nil {
+		return fmt.Errorf("failed to close test file %q: %w", testFile.Name(), err)
+	}
+
+	return nil
+}
+
+// IsDirContentWritable checks if all files and subdirectories inside the directory
+// are writable by the current user.
+func IsDirContentWritable(dirName string) error {
+	err := filepath.WalkDir(dirName, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return fmt.Errorf("directory %q is not accessible: %w", path, err)
+		}
+
+		info, err := d.Info()
+		if err != nil {
+			return fmt.Errorf("cannot get info for %q: %w", path, err)
+		}
+
+		if info.IsDir() {
+			if err := IsDirWritable(path); err != nil {
+				return fmt.Errorf("directory %q is not writable: %w", path, err)
+			}
+		} else {
+			if filepath.Ext(path) == ".control" {
+				return nil
+			}
+
+			f, err := os.OpenFile(path, os.O_RDWR, 0)
+			if err != nil {
+				return fmt.Errorf("file %q is not writable: %w", path, err)
+			}
+			if err = f.Close(); err != nil {
+				return fmt.Errorf("failed to close file %q: %w", path, err)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return fmt.Errorf("failed to check directory content writability for %q: %w",
+			dirName, err)
+	}
+	return nil
+}
+
 // writeYaml writes YAML encoding of object o to fileName.
 func WriteYaml(fileName string, o interface{}) error {
 	file, err := os.Create(fileName)

test/integration/start/test_start.py

@@ -1,3 +1,6 @@
+import os
+import subprocess
+
 import pytest
 import tt_helper
 
@@ -109,3 +112,126 @@ def test_start_multi_inst(tt, tt_app, target):
 )
 def test_start_cluster(tt, tt_app, target):
     check_start(tt, tt_app, target)
+
+
+################################################################
+# Permission denied
+
+
+@pytest.mark.skipif(skip_cluster_cond, reason=skip_cluster_reason)
+@pytest.mark.skipif(
+    os.getuid() == 0,
+    reason="Skipping the test, it shouldn't run as root",
+)
+@pytest.mark.tt_app(**tt_cluster_app)
+@pytest.mark.parametrize(
+    "tt_running_targets",
+    [
+        pytest.param([], id="running:none"),
+    ],
+)
+def test_start_permission_denied(tt, tt_app):
+    var_dir = tt_app.path("var")
+    os.makedirs(var_dir, exist_ok=True)
+    os.chmod(var_dir, 0o444)
+
+    try:
+        rc, out = tt.exec("start")
+        assert rc != 0
+        assert "permission denied" in out.lower()
+    finally:
+        os.chmod(var_dir, 0o755)
+
+
+@pytest.mark.skipif(skip_cluster_cond, reason=skip_cluster_reason)
+@pytest.mark.skipif(
+    os.getuid() == 0,
+    reason="Skipping the test, it shouldn't run as root",
+)
+@pytest.mark.tt_app(**tt_cluster_app)
+@pytest.mark.parametrize(
+    "tt_running_targets",
+    [
+        pytest.param([], id="running:none"),
+    ],
+)
+def test_start_permission_denied_permissions_denied_files(tt, tt_app):
+    rc, _ = tt.exec("start")
+    assert rc == 0
+    assert utils.wait_files(5, tt_helper.pid_files(tt_app, tt_app.instances))
+
+    rc, _ = tt.exec("stop", "-y")
+    assert rc == 0
+
+    log_dir = tt_app.path("var", "log")
+    lib_dir = tt_app.path("var", "lib")
+    run_dir = tt_app.path("var", "run")
+
+    dirs_to_lock = []
+    for data_dir in [log_dir, lib_dir, run_dir]:
+        for root, dirs, files in os.walk(data_dir, topdown=False):
+            dirs_to_lock.extend(os.path.join(root, f) for f in files)
+            dirs_to_lock.extend(os.path.join(root, d) for d in dirs)
+        dirs_to_lock.append(data_dir)
+
+    for d in dirs_to_lock:
+        os.chmod(d, 0o444)
+
+    try:
+        rc, out = tt.exec("start")
+        assert rc != 0
+        assert "permission denied" in out.lower()
+    finally:
+        for d in dirs_to_lock:
+            if os.path.exists(d):
+                os.chmod(d, 0o755)
+
+
+@pytest.mark.skipif(skip_cluster_cond, reason=skip_cluster_reason)
+@pytest.mark.skipif(
+    os.getuid() == 0,
+    reason="Skipping the test, it shouldn't run as root",
+)
+@pytest.mark.tt_app(**tt_cluster_app)
+@pytest.mark.parametrize(
+    "tt_running_targets",
+    [
+        pytest.param([], id="running:none"),
+    ],
+)
+def test_start_permission_denied_rewrite_error(tt, tt_app):
+    data_dirs = [
+        tt_app.path("var", "lib"),
+        tt_app.path("var", "log"),
+        tt_app.path("var", "run"),
+    ]
+
+    for data_dir in data_dirs:
+        os.makedirs(data_dir, exist_ok=True)
+        for instance in tt_app.instances:
+            os.makedirs(os.path.join(data_dir, instance), exist_ok=True)
+
+    for data_dir in data_dirs:
+        if os.path.exists(data_dir):
+            for root, dirs, _ in os.walk(data_dir):
+                for d in dirs:
+                    dpath = os.path.join(root, d)
+                    subprocess.run(
+                        ["setfacl", "-d", "-m", "u::r,g::r,o::r", dpath],
+                        check=True,
+                    )
+
+    try:
+        rc, out = tt.exec("start")
+        assert rc != 0
+        assert "permission denied" in out
+    finally:
+        for data_dir in data_dirs:
+            if os.path.exists(data_dir):
+                for root, dirs, _ in os.walk(data_dir):
+                    for d in dirs:
+                        dpath = os.path.join(root, d)
+                        subprocess.run(
+                            ["setfacl", "-d", "-m", "u::rwx,g::rx,o::rx", dpath],
+                            check=False,
+                        )