# Serious bug (overwrites all /usr/bin permissions) with the Debian-based install script

**URL:** <https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237>\
**Category:** General\
**Created:** [15 October 2021 00:57 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237 "2021-10-15T00:57:17Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [17 October 2021 14:48 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/22 "2021-10-17T14:48:46Z")

</div>

> [@HaroldPetersInskipp](#):
>
> I pushed an updated script for installing node v16.11.1 on armv6 pi's

Does that also install npm?

After installing nodejs 16 the standard pi script should be fine as it will not try to install it again.

---

<div class="post-metadata">

**Author:** ![HaroldPetersInskipp](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/haroldpetersinskipp/32/42319_2.png) [@HaroldPetersInskipp](https://discourse.nodered.org/u/HaroldPetersInskipp)\
**Post date:** [17 October 2021 15:09 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/23 "2021-10-17T15:09:56Z")

</div>

I believe npm version 8.0.0 is bundled with node 16.11.1

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [17 October 2021 15:30 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/24 "2021-10-17T15:30:10Z")

</div>

OK, I wasn't sure if you were picking up the one with it bundled in.

> [@HaroldPetersInskipp](#):
>
> The only issue I noticed was I was missing a symlink to "node-red-pi" in /usr/bin but I could still run "node-red".

If you run the standard install script it should sort that out, I think.

---

<div class="post-metadata">

**Author:** ![HaroldPetersInskipp](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/haroldpetersinskipp/32/42319_2.png) [@HaroldPetersInskipp](https://discourse.nodered.org/u/HaroldPetersInskipp)\
**Post date:** [17 October 2021 15:59 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/25 "2021-10-17T15:59:09Z")

</div>

Yeah it's sorted already anyway permissions look fine and here is the install log:

Already have nodejs v16.11.1  
OLD nodejs 16 :  
NEW nodejs :

* * *

Started : Sun 17 Oct 05:58:52 MDT 2021  
Running for user pi at /home/pi  
Found global nodes: :

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Reading package lists...  
Building dependency tree...  
Reading state information...  
Package 'nodered' is not installed, so not removed  
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Versions: node:v16.11.1 npm:8.0.0  
Now install Node-RED

added 294 packages in 10m  
2.0.6  
Now create basic package.json for the user and move any global nodes  
Installing extra nodes: node-red-node-pi-gpio@latest node-red-node-random@latest node-red-node-ping@latest node-red-contrib-play-audio@latest node-red-node-smooth@latest node-red-node-serialport@latest :

added 64 packages in 3m  
Now add the shortcut and start/stop/log scripts to the menu  
Now add systemd script and configure it for pi  
ln: failed to create symbolic link '/usr/bin/python': File exists  
Now add launcher to top bar, add cpu temp example, make sure ping works  
The user "pi" is already a member of "gpio".  
Memory : 530M  
Started : Sun 17 Oct 05:58:52 MDT 2021  
Finished: Sun 17 Oct 06:13:45 MDT 2021

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [17 October 2021 20:49 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/26 "2021-10-17T20:49:34Z")

</div>

So now I suppose the question is, what is the difference between the method that works and the method in the node red script?

---

<div class="post-metadata">

**Author:** ![lepgithub](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lepgithub/32/49422_2.png) [@lepgithub](https://discourse.nodered.org/u/lepgithub)\
**Post date:** [18 October 2021 03:58 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/27 "2021-10-18T03:58:10Z")

</div>

ok i believe i understand why @HaroldPetersInskipp method works relative to the node-red script. @HaroldPetersInskipp script does not directly extract the nodejs tarball into /usr/bin, but instead extracts to /opt/nodejs and then symlinks to /usr/bin and other bins. this is the key difference, since extracting directly into /usr/bin overwrites the directory ownership from root to pi for several dir under /usr. also /opt/nodejs avoids the new armv6 npm bug that changes file ownership for all files within the node dir. i tested this theory by creating a couple of files with root ownership under /opt/nodejs/bin and after installing node-red via script, root owner again was changed to pi. **example below:**

**before node red install:**  
pi@zero8:/opt/nodejs/bin $ ls -altr  
total 69864  
-rwxr-xr-x 1 pi pi 71376408 Oct 12 10:14 node  
lrwxrwxrwx 1 pi pi 38 Oct 12 10:14 npx -\> ../lib/node\_modules/npm/bin/npx-cli.js  
lrwxrwxrwx 1 pi pi 38 Oct 12 10:14 npm -\> ../lib/node\_modules/npm/bin/npm-cli.js  
lrwxrwxrwx 1 pi pi 45 Oct 12 10:14 corepack -\> ../lib/node\_modules/corepack/dist/corepack.js  
drwxr-xr-x 6 pi pi 4096 Oct 12 10:14 ..  
`-rw-r--r-- 1 root root 0 Oct 17 20:07 test`  
drwxr-xr-x 2 pi pi 4096 Oct 17 20:07 .  
`-rwsr-xr-x 1 root root 147560 Oct 17 20:07 sudo`

**after successful node-red install:**  
pi@zero8:/opt/nodejs/bin $ ls -latr  
total 69864  
-rwxr-xr-x 1 pi pi 71376408 Oct 12 10:14 node  
lrwxrwxrwx 1 pi pi 38 Oct 12 10:14 npx -\> ../lib/node\_modules/npm/bin/npx-cli.js  
lrwxrwxrwx 1 pi pi 38 Oct 12 10:14 npm -\> ../lib/node\_modules/npm/bin/npm-cli.js  
lrwxrwxrwx 1 pi pi 45 Oct 12 10:14 corepack -\> ../lib/node\_modules/corepack/dist/corepack.js  
drwxr-xr-x 6 pi pi 4096 Oct 12 10:14 ..  
`-rw-r--r-- 1 pi pi 0 Oct 17 20:07 test`  
`-rwxr-xr-x 1 pi pi 147560 Oct 17 20:07 sudo`  
lrwxrwxrwx 1 root root 35 Oct 17 20:28 node-red -\> ../lib/node\_modules/node-red/red.js  
lrwxrwxrwx 1 root root 44 Oct 17 20:28 node-red-pi -\> ../lib/node\_modules/node-red/bin/node-red-pi  
drwxr-xr-x 2 pi pi 4096 Oct 17 20:28 .

**node red log:**  
pi@zero8:~ $ cat /var/log/nodered-install.log  
Already have nodejs v16.11.1  
OLD nodejs 16 :  
NEW nodejs :

* * *

Started : Sun 17 Oct 20:21:08 PDT 2021  
Running for user pi at /home/pi  
Failed to stop nodered.service: Unit nodered.service not loaded.  
Found global nodes: :

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Reading package lists...  
Building dependency tree...  
Reading state information...  
Package 'nodered' is not installed, so not removed  
The following package was automatically installed and is no longer required:  
python-colorzero  
Use 'sudo apt autoremove' to remove it.  
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Versions: node:v16.11.1 npm:8.0.0  
Now install Node-RED

added 294 packages in 9m  
2.0.6  
Now create basic package.json for the user and move any global nodes  
Installing extra nodes: node-red-node-pi-gpio@latest node-red-node-random@latest node-red-node-ping@latest node-red-contrib-play-audio@latest node-red-node-smooth@latest node-red-node-serialport@latest :

added 80 packages in 3m  
Now add the shortcut and start/stop/log scripts to the menu  
Now add systemd script and configure it for pi  
ln: failed to create symbolic link '/usr/bin/python': File exists  
Now add launcher to top bar, add cpu temp example, make sure ping works  
The user `pi' is already a member of `gpio'.  
Memory : 530M  
Started : Sun 17 Oct 20:21:08 PDT 2021  
Finished: Sun 17 Oct 20:34:11 PDT 2021  
pi@zero8:~ $

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [18 October 2021 11:47 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/29 "2021-10-18T11:47:53Z")

</div>

OK - it seems to have been the way they have packaged it up... and then when I untar it is all goes sideways... can you try editing the script and change the line 383  
`if sudo tar -zxf /tmp...` to be `if sudo tar -zxof /tmp...` IE add in the `o` flag...  
Looks good to me here... but would like a double check.  
(If you grabbed latest script you will need to comment out lines 362-370 that did the check and aborted the install)

---

<div class="post-metadata">

**Author:** ![lepgithub](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lepgithub/32/49422_2.png) [@lepgithub](https://discourse.nodered.org/u/lepgithub)\
**Post date:** [18 October 2021 16:46 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/30 "2021-10-18T16:46:28Z")

</div>

interesting, tar -zxof (-o = --no-same-owner) will solve overwriting ownership issue, but i thought the npm bug would still cause issues with /usr/bin (at least still clear the SUID permission for sudo and others). however i'm happy to report that it appears tar `-o` option solved the issue. after modifying the node-red install script with `tar -zxof` option on an armv6 device (pi zero) everything installed successfully with a fresh raspberry pi os lite image. hopefully others can verify, but it appears we are good. thanks!

**install w/ modified script:**  
pi@zero8:~ $ ./update-nodejs-and-nodered --node16

Running Node-RED install for user pi at /home/pi on raspbian

This can take 20-30 minutes on the slower Pi versions - please wait.

Stop Node-RED ✔  
Remove old version of Node-RED ✔  
Remove old version of Node.js ✔  
Install Node.js for Armv6 ✔ v16.11.1 Npm 8.0.0  
Clean npm cache ✔  
Install Node-RED core ✔ 2.0.6  
Move global nodes to local -  
Npm rebuild existing nodes ✔  
Install extra Pi nodes ✔  
Add shortcut commands ✔  
Update systemd script ✔

Any errors will be logged to /var/log/nodered-install.log  
All done.  
You can now start Node-RED with the command node-red-start  
or using the icon under Menu / Programming / Node-RED  
Then point your browser to localhost:1880 or http://{your\_pi\_ip-address}:1880

Started : Mon 18 Oct 08:31:14 PDT 2021  
Finished: Mon 18 Oct 08:42:56 PDT 2021  
pi@zero8:~ $ sudo ls  
update-nodejs-and-nodered

**root owner and SUID still intact:**  
pi@zero8:~ $ ls -la /usr/bin/sud\*  
-rwsr-xr-x 1 root root 147560 Jan 20 2021 /usr/bin/sudo  
lrwxrwxrwx 1 root root 4 Jan 20 2021 /usr/bin/sudoedit -\> sudo  
-rwxr-xr-x 1 root root 51060 Jan 20 2021 /usr/bin/sudoreplay  
pi@zero8:~ $

---

<div class="post-metadata">

**Author:** ![lepgithub](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lepgithub/32/49422_2.png) [@lepgithub](https://discourse.nodered.org/u/lepgithub)\
**Post date:** [18 October 2021 19:46 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/31 "2021-10-18T19:46:59Z")

</div>

**clarification:** `tar -xvof` with --node16 is only valid with new installs. upgrades to previous nodejs versions where the owner of /usr/bin has been changed from previous `tar -xvf` extracts will still run into when npm overwrites owner and SUID on sudo. i verified the issue still exist with an older pi zero running --node14 and upgrade via node-red install script to --node16. so it appears permissions will need to be corrected (at least on /usr/bin) before upgrade to --node16.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [18 October 2021 20:49 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/32 "2021-10-18T20:49:19Z")

</div>

If you still have a "bad" node14 - can you try adding `--no-same-owner` to the tar command ?

---

<div class="post-metadata">

**Author:** ![lepgithub](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lepgithub/32/49422_2.png) [@lepgithub](https://discourse.nodered.org/u/lepgithub)\
**Post date:** [18 October 2021 21:04 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/33 "2021-10-18T21:04:42Z")

</div>

my understanding is `--no-same-owner` and `-o` are the same tar arguments, so it doesn't correct a "bad" node14 (or node12) install where ownership has been previously changed. i believe the only option is that the permissions need to be corrected first on /usr/bin before an upgrade to node16.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [18 October 2021 22:56 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/34 "2021-10-18T22:56:12Z")

</div>

ah yes - they do appear to be the same (though not together in the man page.) Must be a flag to get it to overwrite the existing (wrong) flags. (hmm maybe -U ?)

On my "old" node 14 install all the permissions are ok (before I try to upgrade it.)

---

<div class="post-metadata">

**Author:** ![lepgithub](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lepgithub/32/49422_2.png) [@lepgithub](https://discourse.nodered.org/u/lepgithub)\
**Post date:** [18 October 2021 23:51 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/35 "2021-10-18T23:51:04Z")

</div>

i just verified all armv6 nodejs versions (16.11.1, 14.18.1, 12.22.7) will overwrite /usr/bin **root** owner with **pi** owner (also /usr/include, /usr/lib, and /usr/share) if they were previously extracted with `sudo tar -zxf /tmp/node.tgz --strip-components=1 -C /usr`. so it appears v12 and v14 nodejs armv6 that were installed via the previous node-red script will lose `sudo` if upgraded to nodejs v16.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [19 October 2021 11:03 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/36 "2021-10-19T11:03:17Z")

</div>

OK - fix pushed to try and clean up the mess (if detected)

---

<div class="post-metadata">

**Author:** ![lepgithub](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lepgithub/32/49422_2.png) [@lepgithub](https://discourse.nodered.org/u/lepgithub)\
**Post date:** [20 October 2021 17:50 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/37 "2021-10-20T17:50:57Z")

</div>

great, that's awesome.

i'm not a bash script expert, but i believe the condition `if [[-O "/usr/bin/"]]; then` will not verify correctly if the (deb) node-red install script was executed by a non "pi" user?

---

<div class="post-metadata">

**Author:** ![mhendrik](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mhendrik/32/50576_2.png) [@mhendrik](https://discourse.nodered.org/u/mhendrik)\
**Post date:** [6 November 2021 22:17 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/38 "2021-11-06T22:17:04Z")

</div>

I updated today on my raspberry pi zero. With previous version of node 10.

I had this issue. I can not use sudo anymore on my system (""/usr/bin/sudo must be owned by uid 0 and have the setuid bit set""). Is there any way to salvage this or do I have to setup the whole pi from scratch?

```auto
pi@raspberrypi:/ $ ls -la /usr/bin/sud*
-rwxr-xr-x 1 1001 1001 147560 Feb 2 2020 /usr/bin/sudo
lrwxrwxrwx 1 1001 1001 4 Feb 2 2020 /usr/bin/sudoedit -> sudo
-rwxr-xr-x 1 1001 1001 51060 Feb 2 2020 /usr/bin/sudoreplay

```

I also can not start node-red. In my log I have this error:

```auto
***************************************

Started : Sat 06 Nov 2021 09:33:02 PM CET
#
#
#
#FailureMessage Object: 0xb51fbf70

#
# Fatal error in , line 0
# Liftoff bailout should not happen. Cause: Armv6 not supported

#
#
#
#FailureMessage Object: 0xbef23a98

```

Also I had multiple reboots during the install. I assume the pi was overworked.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [6 November 2021 23:44 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/39 "2021-11-06T23:44:24Z")

</div>

If you have a USB sd reader (difficult with a Pi Zero) and a spare SD card with RPiOS on it, maybe mount the card in the working system and run (eg) **sudo chown -R root:root /mount/usb/usr/bin**

If that fixes /usr/bin try reinstalling Node-Red.

It is not normal for a Pi Zero to reboot during installation though. Do you have RPiOS Lite?

---

<div class="post-metadata">

**Author:** ![mhendrik](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mhendrik/32/50576_2.png) [@mhendrik](https://discourse.nodered.org/u/mhendrik)\
**Post date:** [7 November 2021 12:44 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/40 "2021-11-07T12:44:47Z")

</div>

I am happy to report that I have sudo back. I used another Raspian (raspberry pi 4) to mount the sd card of the "broken" one and executed:

```auto
sudo chown -R root:root /media/pi/root/usr/bin
sudo chmod 4755 /media/pi/root/usr/bin/sudo

```

Thank you very much. I have not yet continued with re-installing Node-red as this already took me longer than I am comfortable to admit 😉

edit: No I do not have RPiOS Lite. Normal Raspian, but probably approx 2 years old. I can check later for details

---

<div class="post-metadata">

**Author:** ![6i6i](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/6i6i/32/52639_2.png) [@6i6i](https://discourse.nodered.org/u/6i6i)\
**Post date:** [14 December 2021 12:00 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/41 "2021-12-14T12:00:41Z")

</div>

I had the same problem when upgrading node-red on RaspiOS Bullseye. I got it back to work with another Linux OS and mounting the SD Card.  
I tried to upgrade from nodejs 10 to 16. Is 14 probably safer to install?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [14 December 2021 13:14 UTC](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237/42 "2021-12-14T13:14:25Z")

</div>

> [@6i6i](#):
>
> same problem

Not quite sure what might be changing the permissions on those files. Typically user and group id `1001` would be a standard user but clearly **EVERYTHING** in `/usr/bin` MUST be owned by user and group `0` (root) otherwise something is SERIOUSLY messed up in your system and you should probably rebuild anyway.

Since only root (or a user you have added to the root group - a REALLY BAD idea) can change permissions in `/usr/bin`, it generally implies something that you have done either as root or with sudo when it was working.

> [@6i6i](#):
>
> I tried to upgrade from nodejs 10 to 16. Is 14 probably safer to install?

Depends on your approach to risk 🙂 As long as you are using an LTS version that is supported by Node-RED, you should generally be OK. Occasionally however, it takes contributed nodes a while to catch up. Mostly, forward compatibility is fairly good but occasionally you can have an issue.

[Previous page](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237.md?page=1)

[Next page](https://discourse.nodered.org/t/serious-bug-overwrites-all-usr-bin-permissions-with-the-debian-based-install-script/52237.md?page=3)