Automic Linux Agent Jobs Fail with Permission Denied on RHEL 8/9 due to Sticky Bit
Article ID: 439350
Updated On:
Products
Issue/Introduction
Jobs executed via the Automic Linux Agent fail immediately with a "Permission denied" error.
The error is specific to the creation of report files in the agent's out directory.
U02001049 Unable to start Job 'JOBS.UNIX.TEST', run-id '1234567', reason 'Cannot run program [/bin/bash] as user "jobuser": Cannot run program "/opt/automic/agent/bin/ucexec_pkg": /opt/automic/agent/out/****.TXT (Permission denied)
Environment
- Product: Automic Workload Automation
- Component: UNIX/Linux Agent
- OS: Red Hat Enterprise Linux (RHEL) 8.x, 9.x, or modern Linux distributions with kernel 5.1+
Cause
configuration
Resolution
To resolve this issue, you must ensure the Linux kernel allows the agent process to create files.
Use one of the following two recommended options:
Option 1: Remove the Sticky Bit (Recommended)
If the sticky bit is not required for your security policy on the out folder, removing it will stop the kernel from applying the protected_regular restriction.
The directory permissions should change from drwxrwxrwt to drwxrwxrwx.
Option 2: Change Directory Ownership
Change the owner of the out directory from root to the specific user that executes the jobs (or a common group). When the executing user owns the directory, the kernel security check passes even if the sticky bit is present.
Option 3: Adjust Kernel Parameters (Workaround)
As a temporary workaround, you can disable the kernel protection globally, though this is not recommended for production security:
Edit /etc/sysctl.conf.
Add fs.protected_regular = 0.
Apply changes: sysctl -p
Feedback
