Run Backup Task with Root Permission

[Wikinaut]

I usually run Vorta as a user. However for a complete backup of e.g. the /etc files, I think, it will be necessary to run Vorta as root.

My wish and suggestion is that you describe the best way to perform such backups in your description or readme.

[Wikinaut]

For example, will a mere running as

sudo /home/user/.local/bin/vorta

be sufficient to be able to backup all files including the files belonging to root?

[luckyrat]

I'd also appreciate some further guidance or links to relevant external documentation.

Ultimately I would like to see and use Vorta in the (non-root) user Gnome system tray (Ubuntu 18.04) with auto-start on system start (or at least Gnome login) and have the backups Vorta schedules ran with root permissions so that a full system backup can be taken.

To start with, I tried to just get it to run manually from a terminal window running in Gnome and failed:

<prompt>:~$ sudo vorta
sudo: vorta: command not found
<prompt>:~$ whereis vorta
vorta: /home/<user>/.local/bin/vorta
<prompt>:~$ sudo /home/<user>/.local/bin/vorta
Forking to background (see system tray).
<prompt>:~$ QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'

At this point Vorta did not appear to be running but it may have been only the system tray part of it that was broken. I killed the background process and just ran as a normal user, which at least allows me to backup some files until I get this figured out...

<prompt>:~$ ps -ef | grep vorta
root      9612  4758  1 10:37 pts/0    00:00:00 /usr/bin/python3 /home/<user>/.local/bin/vorta
<user>  9641  8483  0 10:38 pts/0    00:00:00 grep --color=auto vorta
<prompt>:~$ sudo kill 9612
<prompt>:~$ vorta
Forking to background (see system tray).
<prompt>:~$ 

[ThomasWaldmann]

Just as an idea, did not test that yet:

if one uses the fat-binary of borg, it could be owned by root:root and be suid. Then vorta could run as normal user and borg would run as root.

This does NOT work with scripts though (e.g. shell or python), only with binaries.

[m3nu]

Not a fan of such workarounds. With Borg being suid, an attacker could change any file on the machine. (via borg extract)

Personally I'd either put your own user in some kind of "admin group" that has access to /etc or back up system files with Borgmatic running as root. The use case for Vorta is mostly to back up your personal files and home folder.

[luckyrat]

I guess that statements on the front page like "One place to view all point-in-time archives and restore individual files." gave me a different impression of what Vorta is for.

Maybe it's just me that interprets this as it being a complete backup solution for a system but if it is only supposed to be used for some files that's fine, I'll look into what this Borgmatic alternative is instead. Thanks for the advice.

[m3nu]

Vorta is for desktops environments, not servers. Your use case belongs more to the server space. There, a headless solution, like Borgmatic or a shell script will work better with regards to permissions.

If you're motivated you can surely run the backup task with sudo/suid and have full system access. It's just not a scenario we will support.

You can still use Vorta to access and restore those backup repos. I just don't recommend circumventing your local permissions and giving a user application deep system access without knowing your exact situation.

[Wikinaut]

@m3nu wrote

Vorta is for desktops environments, not servers.

Äh, well, but.... for example some /etc files are still as important as user files. And databases.

So I think, as discussed above, at least the preferred-by-the-maintainers view should be explained. If you - for understandable reasons - do not suggest/recommend Vorta for these purposes, this should be mentioned.

[luckyrat]

Vorta is for desktops environments, not servers. Your use case belongs more to the server space.

Fair enough. For context, I'm approaching the Linux backup in the same way as I have always backed up my Windows desktop environment (using tools that take regular differential backups of the entire system to enable both a quick bare-metal restore and fine-grained protection against short-term user file corruption/ransomware/human error). Given how hard I've found it to identify reliable software to achieve this I can entirely believe that it's just not a backup strategy that fits Linux as well as Windows and I will most likely learn more about better strategies as I read about Borgmatic.

I like what I've seen of Vorta so far and may well keep using it as part of a more complete backup solution.

[m3nu]

If you guys are really keen on doing backups as root, then I suggest to just run the borg command with sudo. So borg create ... becomes sudo borg create. Should be simple enough to configure passwordless sudo for just the Borg-command?

The PR for this should be quite simple. This option could be enabled under Misc or as env variable.

Would this solve your use case?