Serious bug (overwrites all /usr/bin permissions) with the Debian-based install script

Does that also install npm?

After installing nodejs 16 the standard pi script should be fine as it will not try to install it again.

I believe npm version 8.0.0 is bundled with node 16.11.1

OK, I wasn't sure if you were picking up the one with it bundled in.

If you run the standard install script it should sort that out, I think.

Yeah it's sorted already anyway permissions look fine and here is the install log:

Already have nodejs v16.11.1
OLD nodejs 16 :
NEW nodejs :


Started : Sun 17 Oct 05:58:52 MDT 2021
Running for user pi at /home/pi
Found global nodes: :

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Reading package lists...
Building dependency tree...
Reading state information...
Package 'nodered' is not installed, so not removed
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Versions: node:v16.11.1 npm:8.0.0
Now install Node-RED

added 294 packages in 10m
2.0.6
Now create basic package.json for the user and move any global nodes
Installing extra nodes: node-red-node-pi-gpio@latest node-red-node-random@latest node-red-node-ping@latest node-red-contrib-play-audio@latest node-red-node-smooth@latest node-red-node-serialport@latest :

added 64 packages in 3m
Now add the shortcut and start/stop/log scripts to the menu
Now add systemd script and configure it for pi
ln: failed to create symbolic link '/usr/bin/python': File exists
Now add launcher to top bar, add cpu temp example, make sure ping works
The user "pi" is already a member of "gpio".
Memory : 530M
Started : Sun 17 Oct 05:58:52 MDT 2021
Finished: Sun 17 Oct 06:13:45 MDT 2021

So now I suppose the question is, what is the difference between the method that works and the method in the node red script?

1 Like

ok i believe i understand why @HaroldPetersInskipp method works relative to the node-red script. @HaroldPetersInskipp script does not directly extract the nodejs tarball into /usr/bin, but instead extracts to /opt/nodejs and then symlinks to /usr/bin and other bins. this is the key difference, since extracting directly into /usr/bin overwrites the directory ownership from root to pi for several dir under /usr. also /opt/nodejs avoids the new armv6 npm bug that changes file ownership for all files within the node dir. i tested this theory by creating a couple of files with root ownership under /opt/nodejs/bin and after installing node-red via script, root owner again was changed to pi. example below:

before node red install:
pi@zero8:/opt/nodejs/bin $ ls -altr
total 69864
-rwxr-xr-x 1 pi pi 71376408 Oct 12 10:14 node
lrwxrwxrwx 1 pi pi 38 Oct 12 10:14 npx -> ../lib/node_modules/npm/bin/npx-cli.js
lrwxrwxrwx 1 pi pi 38 Oct 12 10:14 npm -> ../lib/node_modules/npm/bin/npm-cli.js
lrwxrwxrwx 1 pi pi 45 Oct 12 10:14 corepack -> ../lib/node_modules/corepack/dist/corepack.js
drwxr-xr-x 6 pi pi 4096 Oct 12 10:14 ..
-rw-r--r-- 1 root root 0 Oct 17 20:07 test
drwxr-xr-x 2 pi pi 4096 Oct 17 20:07 .
-rwsr-xr-x 1 root root 147560 Oct 17 20:07 sudo

after successful node-red install:
pi@zero8:/opt/nodejs/bin $ ls -latr
total 69864
-rwxr-xr-x 1 pi pi 71376408 Oct 12 10:14 node
lrwxrwxrwx 1 pi pi 38 Oct 12 10:14 npx -> ../lib/node_modules/npm/bin/npx-cli.js
lrwxrwxrwx 1 pi pi 38 Oct 12 10:14 npm -> ../lib/node_modules/npm/bin/npm-cli.js
lrwxrwxrwx 1 pi pi 45 Oct 12 10:14 corepack -> ../lib/node_modules/corepack/dist/corepack.js
drwxr-xr-x 6 pi pi 4096 Oct 12 10:14 ..
-rw-r--r-- 1 pi pi 0 Oct 17 20:07 test
-rwxr-xr-x 1 pi pi 147560 Oct 17 20:07 sudo
lrwxrwxrwx 1 root root 35 Oct 17 20:28 node-red -> ../lib/node_modules/node-red/red.js
lrwxrwxrwx 1 root root 44 Oct 17 20:28 node-red-pi -> ../lib/node_modules/node-red/bin/node-red-pi
drwxr-xr-x 2 pi pi 4096 Oct 17 20:28 .

node red log:
pi@zero8:~ $ cat /var/log/nodered-install.log
Already have nodejs v16.11.1
OLD nodejs 16 :
NEW nodejs :


Started : Sun 17 Oct 20:21:08 PDT 2021
Running for user pi at /home/pi
Failed to stop nodered.service: Unit nodered.service not loaded.
Found global nodes: :

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Reading package lists...
Building dependency tree...
Reading state information...
Package 'nodered' is not installed, so not removed
The following package was automatically installed and is no longer required:
python-colorzero
Use 'sudo apt autoremove' to remove it.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Versions: node:v16.11.1 npm:8.0.0
Now install Node-RED

added 294 packages in 9m
2.0.6
Now create basic package.json for the user and move any global nodes
Installing extra nodes: node-red-node-pi-gpio@latest node-red-node-random@latest node-red-node-ping@latest node-red-contrib-play-audio@latest node-red-node-smooth@latest node-red-node-serialport@latest :

added 80 packages in 3m
Now add the shortcut and start/stop/log scripts to the menu
Now add systemd script and configure it for pi
ln: failed to create symbolic link '/usr/bin/python': File exists
Now add launcher to top bar, add cpu temp example, make sure ping works
The user `pi' is already a member of `gpio'.
Memory : 530M
Started : Sun 17 Oct 20:21:08 PDT 2021
Finished: Sun 17 Oct 20:34:11 PDT 2021
pi@zero8:~ $

1 Like

OK - it seems to have been the way they have packaged it up... and then when I untar it is all goes sideways... can you try editing the script and change the line 383
if sudo tar -zxf /tmp... to be if sudo tar -zxof /tmp... IE add in the o flag...
Looks good to me here... but would like a double check.
(If you grabbed latest script you will need to comment out lines 362-370 that did the check and aborted the install)

interesting, tar -zxof (-o = --no-same-owner) will solve overwriting ownership issue, but i thought the npm bug would still cause issues with /usr/bin (at least still clear the SUID permission for sudo and others). however i'm happy to report that it appears tar -o option solved the issue. after modifying the node-red install script with tar -zxof option on an armv6 device (pi zero) everything installed successfully with a fresh raspberry pi os lite image. hopefully others can verify, but it appears we are good. thanks!

install w/ modified script:
pi@zero8:~ $ ./update-nodejs-and-nodered --node16

Running Node-RED install for user pi at /home/pi on raspbian

This can take 20-30 minutes on the slower Pi versions - please wait.

Stop Node-RED :heavy_check_mark:
Remove old version of Node-RED :heavy_check_mark:
Remove old version of Node.js :heavy_check_mark:
Install Node.js for Armv6 :heavy_check_mark: v16.11.1 Npm 8.0.0
Clean npm cache :heavy_check_mark:
Install Node-RED core :heavy_check_mark: 2.0.6
Move global nodes to local -
Npm rebuild existing nodes :heavy_check_mark:
Install extra Pi nodes :heavy_check_mark:
Add shortcut commands :heavy_check_mark:
Update systemd script :heavy_check_mark:

Any errors will be logged to /var/log/nodered-install.log
All done.
You can now start Node-RED with the command node-red-start
or using the icon under Menu / Programming / Node-RED
Then point your browser to localhost:1880 or http://{your_pi_ip-address}:1880

Started : Mon 18 Oct 08:31:14 PDT 2021
Finished: Mon 18 Oct 08:42:56 PDT 2021
pi@zero8:~ $ sudo ls
update-nodejs-and-nodered

root owner and SUID still intact:
pi@zero8:~ $ ls -la /usr/bin/sud*
-rwsr-xr-x 1 root root 147560 Jan 20 2021 /usr/bin/sudo
lrwxrwxrwx 1 root root 4 Jan 20 2021 /usr/bin/sudoedit -> sudo
-rwxr-xr-x 1 root root 51060 Jan 20 2021 /usr/bin/sudoreplay
pi@zero8:~ $

clarification: tar -xvof with --node16 is only valid with new installs. upgrades to previous nodejs versions where the owner of /usr/bin has been changed from previous tar -xvf extracts will still run into when npm overwrites owner and SUID on sudo. i verified the issue still exist with an older pi zero running --node14 and upgrade via node-red install script to --node16. so it appears permissions will need to be corrected (at least on /usr/bin) before upgrade to --node16.

If you still have a "bad" node14 - can you try adding --no-same-owner to the tar command ?

my understanding is --no-same-owner and -o are the same tar arguments, so it doesn't correct a "bad" node14 (or node12) install where ownership has been previously changed. i believe the only option is that the permissions need to be corrected first on /usr/bin before an upgrade to node16.

ah yes - they do appear to be the same (though not together in the man page.) Must be a flag to get it to overwrite the existing (wrong) flags. (hmm maybe -U ?)

On my "old" node 14 install all the permissions are ok (before I try to upgrade it.)

i just verified all armv6 nodejs versions (16.11.1, 14.18.1, 12.22.7) will overwrite /usr/bin root owner with pi owner (also /usr/include, /usr/lib, and /usr/share) if they were previously extracted with sudo tar -zxf /tmp/node.tgz --strip-components=1 -C /usr. so it appears v12 and v14 nodejs armv6 that were installed via the previous node-red script will lose sudo if upgraded to nodejs v16.

OK - fix pushed to try and clean up the mess (if detected)

great, that's awesome.

i'm not a bash script expert, but i believe the condition if [[ -O "/usr/bin/" ]]; then will not verify correctly if the (deb) node-red install script was executed by a non "pi" user?

I updated today on my raspberry pi zero. With previous version of node 10.

I had this issue. I can not use sudo anymore on my system (""/usr/bin/sudo must be owned by uid 0 and have the setuid bit set""). Is there any way to salvage this or do I have to setup the whole pi from scratch?

pi@raspberrypi:/ $ ls -la /usr/bin/sud*
-rwxr-xr-x 1 1001 1001 147560 Feb  2  2020 /usr/bin/sudo
lrwxrwxrwx 1 1001 1001      4 Feb  2  2020 /usr/bin/sudoedit -> sudo
-rwxr-xr-x 1 1001 1001  51060 Feb  2  2020 /usr/bin/sudoreplay

I also can not start node-red. In my log I have this error:

***************************************

Started : Sat 06 Nov 2021 09:33:02 PM CET
#
#
#
#FailureMessage Object: 0xb51fbf70


#
# Fatal error in , line 0
# Liftoff bailout should not happen. Cause: Armv6 not supported

#
#
#
#FailureMessage Object: 0xbef23a98

Also I had multiple reboots during the install. I assume the pi was overworked.

If you have a USB sd reader (difficult with a Pi Zero) and a spare SD card with RPiOS on it, maybe mount the card in the working system and run (eg) sudo chown -R root:root /mount/usb/usr/bin

If that fixes /usr/bin try reinstalling Node-Red.

It is not normal for a Pi Zero to reboot during installation though. Do you have RPiOS Lite?

I am happy to report that I have sudo back. I used another Raspian (raspberry pi 4) to mount the sd card of the "broken" one and executed:

sudo chown -R root:root /media/pi/root/usr/bin
sudo chmod 4755 /media/pi/root/usr/bin/sudo

Thank you very much. I have not yet continued with re-installing Node-red as this already took me longer than I am comfortable to admit :wink:

edit: No I do not have RPiOS Lite. Normal Raspian, but probably approx 2 years old. I can check later for details

I had the same problem when upgrading node-red on RaspiOS Bullseye. I got it back to work with another Linux OS and mounting the SD Card.
I tried to upgrade from nodejs 10 to 16. Is 14 probably safer to install?

Not quite sure what might be changing the permissions on those files. Typically user and group id 1001 would be a standard user but clearly EVERYTHING in /usr/bin MUST be owned by user and group 0 (root) otherwise something is SERIOUSLY messed up in your system and you should probably rebuild anyway.

Since only root (or a user you have added to the root group - a REALLY BAD idea) can change permissions in /usr/bin, it generally implies something that you have done either as root or with sudo when it was working.

Depends on your approach to risk :slight_smile: As long as you are using an LTS version that is supported by Node-RED, you should generally be OK. Occasionally however, it takes contributed nodes a while to catch up. Mostly, forward compatibility is fairly good but occasionally you can have an issue.