Chef script ressource: how does the user context work?

Question

I'm trying to install pm2 and pm2-logrotate as non root user (specifically, using nginx user), with Chef 12

I installed pm2 globally

[root@~] npm install -g pm2

Then I registered pm2 startup script to run as nginx user

[root@~] pm2 startup -u nginx --hp /home/nginx systemd  

Then I want to install pm2-logrotate for the pm2 process running as nginx user

The following works: pm2-logrotate is correctly installed, and the logs under /home/nginx/.pm2/logs are rotated

script "pm2_logrotate" do
  interpreter 'bash'
  code <<-EOH
    su nginx -c "pm2 install pm2-logrotate@2.4.0"
  EOH
end

But if I try to install pm2-logrotate by specifying the "nginx" user for the script ressource, I get an error

script "pm2_logrotate" do
  interpreter 'bash'
  user "nginx"
  code <<-EOH
    pm2 install pm2-logrotate@2.4.0
  EOH
end

Error

[PM2][Module] Calling [NPM] to install pm2-logrotate@2.4.0 ... ==> default: Error: EACCES: permission denied, mkdir '/root/.pm2/modules/pm2-logrotate'

Why is there a different behaviour ? Thanks

Answer 1

The problem is that when Chef changes the user to nginx, it doesn't export some of the environment variables that bash sets on startup, in this case probably $HOME. You can fix this with:

script "pm2_logrotate" do
  interpreter 'bash'
  user "nginx"
  environment 'HOME' => Dir.home(user)
  code <<-EOH
    pm2 install pm2-logrotate@2.4.0
  EOH
end