Permission denied and AccessDeniedException[/usr/share/wazuh-indexer/config/opensearch.yml] when running 'sudo docker compose up -d' on single-node

[henning410]

Firstly, I want to highlight that the certification creation is not running as expected from the documentation.
According to the docs, you only need to run docker compose -f generate-indexer-certs.yml run --rm generator. However, this produces the error:
/config/wazuh_indexer_ssl_certs' does not exist
I got this fixed by manually creating the wazuh_indexer_ssl_certs folder. I think this should be adjusted in the documentation.

After creating the certificates, I tried to start the container wiith docker compose up -d as mentioned in the docs.
I get the following errors:

wazuh-wazuh.indexer-1    | grep: /usr/share/wazuh-indexer/config/opensearch.yml: Permission denied
wazuh-wazuh.indexer-1    | grep: /usr/share/wazuh-indexer/config/opensearch.yml: Permission denied
...
wazuh-wazuh.indexer-1    | Exception in thread "main"
wazuh-wazuh.indexer-1    | SettingsException[Failed to load settings from /usr/share/wazuh-indexer/config/opensearch.yml]; nested: AccessDeniedException[/usr/share/wazuh-indexer/config/opensearch.yml];
wazuh-wazuh.indexer-1    |      at org.opensearch.node.InternalSettingsPreparer.prepareEnvironment(InternalSettingsPreparer.java:98)
wazuh-wazuh.indexer-1    |      at org.opensearch.cli.EnvironmentAwareCommand.createEnv(EnvironmentAwareCommand.java:118)
wazuh-wazuh.indexer-1    |      at org.opensearch.cli.EnvironmentAwareCommand.createEnv(EnvironmentAwareCommand.java:109)
wazuh-wazuh.indexer-1    |      at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
wazuh-wazuh.indexer-1    |      at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
wazuh-wazuh.indexer-1    |      at org.opensearch.cli.MultiCommand.execute(MultiCommand.java:104)
wazuh-wazuh.indexer-1    |      at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
wazuh-wazuh.indexer-1    |      at org.opensearch.cli.Command.main(Command.java:101)
wazuh-wazuh.indexer-1    |      at org.opensearch.common.settings.KeyStoreCli.main(KeyStoreCli.java:56)
wazuh-wazuh.indexer-1    | Caused by: java.nio.file.AccessDeniedException: /usr/share/wazuh-indexer/config/opensearch.yml
wazuh-wazuh.indexer-1    |      at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
wazuh-wazuh.indexer-1    |      at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)
wazuh-wazuh.indexer-1    |      at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
wazuh-wazuh.indexer-1    |      at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:261)
wazuh-wazuh.indexer-1    |      at java.base/java.nio.file.Files.newByteChannel(Files.java:380)
wazuh-wazuh.indexer-1    |      at java.base/java.nio.file.Files.newByteChannel(Files.java:432)
wazuh-wazuh.indexer-1    |      at java.base/java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:420)
wazuh-wazuh.indexer-1    |      at java.base/java.nio.file.Files.newInputStream(Files.java:160)
wazuh-wazuh.indexer-1    |      at org.opensearch.common.settings.Settings$Builder.loadFromPath(Settings.java:1117)
wazuh-wazuh.indexer-1    |      at org.opensearch.node.InternalSettingsPreparer.prepareEnvironment(InternalSettingsPreparer.java:96)
wazuh-wazuh.indexer-1    |      ... 8 more
wazuh-wazuh.indexer-1    | WARNING: Using incubator modules: jdk.incubator.vector
wazuh-wazuh.indexer-1    | WARNING: A terminally deprecated method in java.lang.System has been called
wazuh-wazuh.indexer-1    | WARNING: System::setSecurityManager has been called by
wazuh-wazuh.indexer-1    | org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.19.4.jar)
wazuh-wazuh.indexer-1    | WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
wazuh-wazuh.indexer-1    | WARNING: System::setSecurityManager will be removed in a future release
...
wazuh-wazuh.dashboard-1  | Created OpenSearch Dashboards keystore in /usr/share/wazuh-dashboard/config/opensearch_dashboards.keystore
wazuh-wazuh.dashboard-1  |
wazuh-wazuh.dashboard-1  |
wazuh-wazuh.dashboard-1  | grep: /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml: Permission denied
wazuh-wazuh.dashboard-1  | /wazuh_app_config.sh: line 40: /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml: Permission denied
wazuh-wazuh.dashboard-1  | node:internal/fs/utils:351
wazuh-wazuh.dashboard-1  |     throw err;
wazuh-wazuh.dashboard-1  |     ^
wazuh-wazuh.dashboard-1  |
wazuh-wazuh.dashboard-1  | Error: EACCES: permission denied, open '/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml'
wazuh-wazuh.dashboard-1  |     at Object.openSync (node:fs:596:3)
wazuh-wazuh.dashboard-1  |     at Object.readFileSync (node:fs:464:35)
wazuh-wazuh.dashboard-1  |     at readYaml (/usr/share/wazuh-dashboard/node_modules/@osd/apm-config-loader/target/utils/read_config.js:37:52)
wazuh-wazuh.dashboard-1  |     at exports.getConfigFromFiles (/usr/share/wazuh-dashboard/node_modules/@osd/apm-config-loader/target/utils/read_config.js:62:22)
wazuh-wazuh.dashboard-1  |     at exports.loadConfiguration (/usr/share/wazuh-dashboard/node_modules/@osd/apm-config-loader/target/config_loader.js:43:38)
wazuh-wazuh.dashboard-1  |     at module.exports (/usr/share/wazuh-dashboard/src/apm.js:54:15)
wazuh-wazuh.dashboard-1  |     at Object.<anonymous> (/usr/share/wazuh-dashboard/src/cli/dist.js:33:18)
wazuh-wazuh.dashboard-1  |     at Module._compile (node:internal/modules/cjs/loader:1356:14)
wazuh-wazuh.dashboard-1  |     at Module._extensions..js (node:internal/modules/cjs/loader:1414:10)
wazuh-wazuh.dashboard-1  |     at Module.load (node:internal/modules/cjs/loader:1197:32) {
wazuh-wazuh.dashboard-1  |   errno: -13,
wazuh-wazuh.dashboard-1  |   syscall: 'open',
wazuh-wazuh.dashboard-1  |   code: 'EACCES',
wazuh-wazuh.dashboard-1  |   path: '/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml'
wazuh-wazuh.dashboard-1  | }

Steps to reproduce:

1. Download latest release v4.14.3
2. In the config folder, create some wazuh_indexer_ssl_certs folder
3. Run docker compose -f generate-indexer-certs.yml run --rm generator
4. Run docker compose up -d

The only thing I changed is the dashboard port from 443 to 5601, because I received some message that the port is already in use.
I am running this on some Synology NAS with version DSM 7.3.2-86009 Update 1