If a program requires write permission how should I set it with chown? Specifically, what would program foo's permissions be to solve this error?

failed to create pid file '/var/run/bar.pid': Permission denied

3 Answers 3


If you have a program foo trying to create/write to a file, the permissions of the foo binary don't matter, but the user it's running as makes all the difference.

In this case, foo is trying to write to /var/run, which is owned by root and only writable by root.

So you would have to run the program as sudo foo for it to create that PID file. Please consider the security implications of allowing a program to run as root before you do it...

  • if the permission on the binaries are something: rw-r-r then would the program be executable given that i am running the program as root i.e allowing to create a process id under /var/run ?
    – Ankit
    Aug 10, 2012 at 9:21
  • @Ankit: if a binary has no executable permissions at all it won't "run"; but anything you do run as root will be able to create a pid under /var/run
    – ish
    Aug 10, 2012 at 9:34
  • Alternatively, write the pid file elsewhere (many applications let you specify the path to the pid file).
    – msanford
    Jul 13, 2015 at 18:23

What I did is simply add the creation of a folder just before the start-stop-deamon is executed. This works because the script is generally executed as root during start up. It just creates the folder in /var/run and changes the owner immediately, so a PID can be written.

In the example below, I check for the existence of the subfolder of /var/run where i put the PIDs as the current run user, in this case user 'pi' (since I am on a raspberry).

Also check this link since it was very educational to me: Python script to run as service, however, it did not cover the problem discussed here.

Example portion of my shell script:

# The process ID of the script when it runs is stored here:

do_start () {
    log_daemon_msg "Starting system $DAEMON_NAME daemon"
    if [ ! -d /var/run/power ]; then
        mkdir /var/run/power/
        chown pi:pi /var/run/power/
    start-stop-daemon --start --background --pidfile $PIDFILE --make-pidfile --user $DAEMON_USER --chdir $DIR --startas $DAEMON -- $DAEMON_OPTS
    log_end_msg $?

General approach: determine the user and group of the process trying to access the file. This is often found in the configuration of the software (such as webservers/mailservers/...), but if the software is already running use this:

ps aux 

Look for the process you want to configure access rights for. The first column tells you under which username it's running.

groups <username>

This will tell you to which groups the user belongs.

Change the owner or group of the file to match the service.

Note 1: As the question points out that the file is in /var/run/ I'm assuming only one process needs access, if this is not true, you shouldn't change owner or group, but you might consider adding the process' user to the group or creating a new group for this file/folder.

Note 2: Funny things can happen with apparmor, which is a security system: it can prevent processes from writing to files and folders to which they have (on filesystem level) all necessary rights. With aa-status you can see whether a specific rule for your service is active.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.