Dynamic user not working with acap-native-sdk 1.15

[embeddeddev4]

I have moved my project to build from acap-sdk 3.0 to the latest acap-native-sdk version 1.15, and updated my camera fw to 11.11. For some reason whenever I install my project it is not creating a dynamic user although I left the username and group fields out of my manifest. When I install my app the user is defaulted to sdk and I have lost access to read the CWD from my application, and I am denied connection to the metadata broker. Below is a sample of my manifest.

{
    "schemaVersion": "1.7.0",
    "acapPackageConf": {
        "setup": {
            "friendlyName": "app_manager",
            "appName": "app_manager",
            "vendor": "CompanyName",
            "embeddedSdkVersion": "3.0",
            "vendorUrl": "https://www.company.com",
            "runMode": "respawn",
            "version": "1.0.0"
        }
    }
}

I downloaded and installed a sample metadatabroker project from the axis github repo (built from the same docker repo as well) and it installs just like it should. It creates a dynamic user and I can connect to the broker.

The only difference I have noticed is the system logs are different when installing each app. I can see the sample project being installed with proper permissions to the broker and usernames being created using the acapctl process, while mine just seems to untar and default to the sdk user using the install-package.sh script. Any clue what is going on? I'll attach the system logs of both installs, consume_analytics_metadata is the sample project.

systemlog.txt

[github-actions[bot]]

This automatically generated reply acts as a friendly reminder.

Answers to your questions will most often come from the community, from developers like yourself. You will, from time to time, find that Axis employees answers some of the questions, but this is not a guarantee. Think of the discussion forum as a complement to other support channels, not a replacement to any of them.

If your question remains unanswered for a period of time, please revisit it to see whether it can be improved by following the guidelines listed in Axis support guidelines.

[vivekatoffice]

Hi @embeddeddev4 ,
As per my understanding, you can take reference to the /axstorage/app/Makefile file:

I tried following the changes to the metadata-broker/consume-analytics-scene-description example and able to write a file ACAP directory:

consume_analytics_metadata.c

/**
 * Copyright (C) 2024 Axis Communications AB, Lund, Sweden
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     <http://www.apache.org/licenses/LICENSE-2.0>
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/**
 * This example creates a Metadata Broker subscriber for the
 * analytics_scene_description topic. Streamed messages are received in the
 * Analytics Data Format (ADF) and is logged to syslog.
 */

#include <signal.h>
#include <stdio.h>
#include <string.h>
#include <sys/syslog.h>
#include <syslog.h>
#include <time.h>
#include <unistd.h>  // For getcwd()
#include <limits.h>  // For PATH_MAX
#include <mdb/connection.h>
#include <mdb/error.h>
#include <mdb/subscriber.h>

typedef struct channel_identifier {
    char* topic;
    char* source;
} channel_identifier_t;

static void on_connection_error(mdb_error_t* error, void* user_data) {
    (void)user_data;

    syslog(LOG_ERR, "Got connection error: %s, Aborting...", error->message);

    abort();
}

static void on_message(const mdb_message_t* message, void* user_data) {
    const struct timespec* timestamp     = mdb_message_get_timestamp(message);
    const mdb_message_payload_t* payload = mdb_message_get_payload(message);

    channel_identifier_t* channel_identifier = (channel_identifier_t*)user_data;

    // Log the message to syslog
    syslog(LOG_INFO,
           "message received from topic: %s on source: %s: Monotonic time - "
           "%lld.%.9ld. Data - %.*s",
           channel_identifier->topic,
           channel_identifier->source,
           (long long)timestamp->tv_sec,
           timestamp->tv_nsec,
           (int)payload->size,
           (char*)payload->data);

    // Get the current working directory
    char current_dir[PATH_MAX];
    if (getcwd(current_dir, sizeof(current_dir)) == NULL) {
        syslog(LOG_ERR, "Failed to get current working directory");
        return;
    }

    // Define the log file name and check that the total path length fits
    const char *log_filename = "/vivek.log";
    size_t dir_len = strlen(current_dir);
    size_t file_len = strlen(log_filename);

    // Check if the combined path length is within PATH_MAX
    if (dir_len + file_len + 1 > PATH_MAX) {  // +1 for null-terminator
        syslog(LOG_ERR, "Current directory path is too long to append log file name");
        return;
    }

    // Create the full path to the output file
    char output_file_path[PATH_MAX];
    snprintf(output_file_path, sizeof(output_file_path), "%s%s", current_dir, log_filename);

    // Open the file in append mode
    FILE* file = fopen(output_file_path, "a");
    if (file == NULL) {
        syslog(LOG_ERR, "Failed to open file: %s", output_file_path);
        return;
    }

    // Write the message to the file
    fprintf(file,
            "message received from topic: %s on source: %s: Monotonic time - "
            "%lld.%.9ld. Data - %.*s\n",
            channel_identifier->topic,
            channel_identifier->source,
            (long long)timestamp->tv_sec,
            timestamp->tv_nsec,
            (int)payload->size,
            (char*)payload->data);

    // Close the file
    fclose(file);
}

static void on_done_subscriber_create(const mdb_error_t* error, void* user_data) {
    if (error != NULL) {
        syslog(LOG_ERR, "Got subscription error: %s, Aborting...", error->message);
        abort();
    }
    channel_identifier_t* channel_identifier = (channel_identifier_t*)user_data;

    syslog(LOG_INFO,
           "Subscribed to %s (%s)...",
           channel_identifier->topic,
           channel_identifier->source);
}

static void sig_handler(int signum) {
    (void)signum;
    // Do nothing, just let pause in main return.
}

int main(int argc, char** argv) {
    (void)argc;
    (void)argv;
    syslog(LOG_INFO, "Subscriber started...");

    // For com.axis.analytics_scene_description.v0.beta source corresponds to the
    // video channel number.
    channel_identifier_t channel_identifier    = {.topic =
                                                      "com.axis.analytics_scene_description.v0.beta",
                                                  .source = "1"};
    mdb_error_t* error                         = NULL;
    mdb_subscriber_config_t* subscriber_config = NULL;
    mdb_subscriber_t* subscriber               = NULL;

    mdb_connection_t* connection = mdb_connection_create(on_connection_error, NULL, &error);
    if (error != NULL) {
        goto end;
    }

    subscriber_config = mdb_subscriber_config_create(channel_identifier.topic,
                                                     channel_identifier.source,
                                                     on_message,
                                                     &channel_identifier,
                                                     &error);
    if (error != NULL) {
        goto end;
    }

    subscriber = mdb_subscriber_create_async(connection,
                                             subscriber_config,
                                             on_done_subscriber_create,
                                             &channel_identifier,
                                             &error);
    if (error != NULL) {
        goto end;
    }

    // Add signal handler to allow for cleanup on ordered termination.
    (void)signal(SIGTERM, sig_handler);

    pause();

end:
    if (error != NULL) {
        syslog(LOG_ERR, "%s", error->message);
    }

    mdb_error_destroy(&error);
    mdb_subscriber_config_destroy(&subscriber_config);
    mdb_subscriber_destroy(&subscriber);
    mdb_connection_destroy(&connection);

    syslog(LOG_INFO, "Subscriber closed...");

    return 0;
}

Makefile

PROG1	= consume_analytics_metadata
OBJS1	= $(PROG1).c
PROGS	= $(PROG1)
DEBUG_DIR = debug

PKGS = mdb

CFLAGS += $(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --cflags $(PKGS))
LDLIBS += $(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --libs $(PKGS))

CFLAGS += \
					-Wall \
					-Wextra \
					-Wpedantic \
					-Wmissing-prototypes \
					-Wstrict-prototypes \
					-Wfloat-equal \
					-Winline \
					-Wbad-function-cast \
					-Wstack-protector \
					-Wpointer-arith \
					-Werror

CFLAGS_DEBUG = -g3 -O0

all: $(PROGS)

$(PROG1): $(OBJS1)
	# Create debug directory and build binary with debug symbols
	install -d $(DEBUG_DIR)

	$(CC) $^ $(CFLAGS) $(CFLAGS_DEBUG) $(LIBS) $(LDFLAGS) $(LDLIBS) -o $(DEBUG_DIR)/$@
	cp $(DEBUG_DIR)/$@ .
	$(STRIP) $@

clean:
	rm -rf $(PROGS) $(DEBUG_DIR) *.o *.eap* *_LICENSE.txt package.conf* param.conf tmp*

manifest.json

{
    "schemaVersion": "1.7.0",
    "resources": {
        "linux": {
            "user": {
                "groups": [
                    "storage"
                ]
            }
        }
    },
    "acapPackageConf": {
        "setup": {
            "appName": "consume_analytics_metadata",
            "vendor": "Axis Communications",
            "embeddedSdkVersion": "3.0",
            "vendorUrl": "https://www.axis.com",
            "runMode": "never",
            "version": "1.0.0"
        }
    }
}

Output:

[embeddeddev4]

Hi Vivek,

Unfortunately I've tried everything you've listed in my application. Without the storage user group I can get cwd in the example project as well. I have tried adding the usergroup storage to my project's manifest and it still is installing my user as the old "sdk" user with no permission to retrieve cwd.

[embeddeddev4]

[embeddeddev4]

I found where the issue lies, my project requires additional files and directories that I am passing to the acap-build script using the -a parameter. When I remove passing these files and folders to the build my installation works as expected. Any clue how to circumvent this as it was ok in 3.0 and I see the additional files param still in the acap-build script.

[embeddeddev4]

@vivekatoffice I was able to fix it. For some reason another developer was passing along the manifest.json file as an additional file to the acap-build script. Passing this manifest file forced the installation to install the package using the pre 4.0 installation process and cause permissions issues. After removing it everything works as normal!