Skip to content

Fix screen multiuser attach permission error - #142

Merged
elyxlz merged 2 commits into
masterfrom
fix-attach-ssh-port
Nov 19, 2025
Merged

Fix screen multiuser attach permission error#142
elyxlz merged 2 commits into
masterfrom
fix-attach-ssh-port

Conversation

@elyxlz

@elyxlz elyxlz commented Nov 19, 2025

Copy link
Copy Markdown
Owner

Summary

  • Fixes the "seteuid: Operation not permitted" error when using nx attach with remote servers
  • Removes the problematic sudo -u nexus screen -X acladd command
  • Pre-grants screen session access to all users at creation time instead

Problem

After adding SSH port support, nx attach started failing with:

seteuid: Operation not permitted
Connection to <host> closed.
SSH attach failed (exit 1)

Root Cause: The sudo -u nexus screen -X acladd command creates a privilege conflict with screen's setuid mechanism. When screen has the setuid bit set (required for multiuser mode), wrapping it in sudo -u confuses screen's internal privilege management, causing the seteuid() syscall to fail.

Solution

Based on extensive research of GNU screen documentation and community solutions:

Before: Runtime ACL manipulation via sudo -u nexus screen -X acladd <user>
After: Pre-configure multiuser permissions at session creation time

Changes

File: src/nexus/server/core/job.py

  • Added aclchg :+rwx "#" to SCREENRC_CONTENT (line 37)
  • This grants read/write/execute permissions to all users when the session is created

File: src/nexus/cli/jobs.py

  • Removed the entire first SSH call that ran sudo -u nexus screen -X acladd
  • Users can now attach directly since permissions are pre-granted

Why This Works

  1. Avoids privilege conflicts: No runtime sudo wrapper interfering with screen's setuid
  2. Simpler architecture: Permissions set once at creation, not on every attach
  3. More reliable: Follows GNU screen's recommended pattern for multiuser sessions
  4. Better performance: One less SSH round-trip on every attach

Test Plan

  • Create a new job on remote server
  • Verify nx attach <job_id> works without seteuid errors
  • Verify multiuser sessions work correctly
  • Run uv run pyright to verify type safety (passes ✓)

Version

Bumped to 0.5.31b1 (beta) as this changes core screen session behavior.

🤖 Generated with Claude Code

elyxlz and others added 2 commits November 19, 2025 11:45
Remove the failing sudo -u nexus screen -X acladd command that caused "seteuid: Operation not permitted" errors. Instead, grant all users access at session creation time by adding "aclchg :+rwx \"#\"" to the screenrc configuration.

This approach:
- Avoids the privilege conflict between sudo -u and screen's setuid
- Grants permissions upfront rather than at attach time
- Eliminates the need for runtime ACL manipulation
- Works reliably across all screen versions

Changes:
- server/core/job.py: Add aclchg command to SCREENRC_CONTENT
- cli/jobs.py: Remove the acladd SSH command from attach flow

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
@elyxlz
elyxlz force-pushed the fix-attach-ssh-port branch from af30e45 to 6ed90df Compare November 19, 2025 11:45
@elyxlz
elyxlz merged commit cb5b9e2 into master Nov 19, 2025
4 checks passed
@elyxlz
elyxlz deleted the fix-attach-ssh-port branch November 19, 2025 11:47
@elyxlz elyxlz mentioned this pull request Nov 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant