Setting up an R Admin Group

When I set up an R server for clients they often want to be able to install packages so that all users on the machine have access to them. This requires them to be able to install the packages onto the root filesystem rather that under their individual home directories.

It would be easy enough to give them su access, but this is a risky approach. There are so many other things on the system that they could break with this level of power.

There is a useful alternative though: simply set up an R Admin Group and add them to it.

The Problem

A normal user does not have access to the system R library.

> install.packages("rvest")
Installing package into ‘/usr/local/lib/R/site-library’
(as ‘lib’ is unspecified)
Warning in install.packages("rvest") :
  'lib = "/usr/local/lib/R/site-library"' is not writable
Would you like to use a personal library instead? (yes/No/cancel)

So R asks whether you want to install the package into a personal library, located in your home folder. This is fine if only you will be working with the package. But if you want the package to be available to all users on the system then this is not going to work.

Existing Staff Group

Let’s take a look at who owns the system R library.

$ ls -l /usr/local/lib/R/
drwxrwsr-x 100 root staff 4096 Apr 11 07:43 site-library

The folder is owned by the root user and has group staff.

We can immediately use this. Simply add users to the staff group.

$ sudo gpasswd -a wookie staff

The wookie user would need to login again for the changes to take effect.

Create an R Admin Group

Alternatively we can create a separate r-admin group.

$ sudo groupadd r-admin

Again we’d need to add users to that group.

$ sudo gpasswd -a wookie r-admin

But we’d also need to change the group ownership of the system R library.

$ sudo chgrp r-admin /usr/local/lib/R/site-library/
$ ls -l /usr/local/lib/R/
drwxrwsr-x 100 root r-admin 4096 Apr 11 07:43 site-library

Install to System Library

Regardless of which approach you took, the wookie user should now be able to install directly to the system R library.

> Sys.info()["user"]
    user 
"wookie" 
> install.packages("rvest")
Installing package into ‘/usr/local/lib/R/site-library’

Success!

Both of the above approaches (staff and r-admin groups) will work, however, the first is potentially insecure because the users in the staff group will have access to all resources associated with that group. Using a group specifically for R administration is much more secure.

Using this recipe will reduce your burden as administrator because it empowers a select subset of users to manage system packages. However, at the same time, it limits the power of those users to cause mayhem.