When I upload a new Inspec profile to Chef Automate, I get the following error:

rpc error: code = InvalidArgument desc = Check InSpec check failed for /hab/svc/compliance-service/var/tmp/inspec-upload549574167.tar.gz with message: exit status 1
2019/03/13 16:51:46 permission denied

A mounted volume which contains the /hab/ directory could cause the above failure. The nosuid mount option specifies that the filesystem cannot contain set userid files. Preventing setuid binaries on a world-writable filesystem makes sense because there's a risk of root escalation or other awfulness there but also prevents executables like inspec from being run. You can run mount | grep nosuid and see whether the /hab directory should be affected by that flag.

Additionally, if you have changed the backup location for Automate and also symlinked the /hab directory to another location this can cause a similar issue in some cases.

Changing permissions on Automate's files and directories under /hab

Running SELinux while not set to Permissive

SELinux

As a first measure we ask that users check and ensure that SELinux is disabled. If you require SELinux its important to check and ensure it is disabled, or if it is enabled, that there is an allow policy in place for the nobody user / nogroup group to access the inspec hidden cache where profiles are stored to test:

/hab/svc/compliance-service/var/tmp/.inspec/

You would also required many other entries to allow Automate to operate. Best to just set SELinux to Permissive mode or disable it entirely.

Permissions

The most likely cause of this issue is incorrect permissions on the /hab directory which needs to be 755. The reason for this is because a process that validates the uploaded profile before it's saved to the asset store runs as the nobody user and will not be able to access Automate's temp or the inspec cache folders when the permissions used by Automate are changed.

Along with /hab check the permissions for: /hab/svc/compliance-service/var/tmp and /hab/svc/compliance-service/var/tmp/.inspec/. These directories will also have special permissions that need to be set correctly for profile uploads to work.

Example of Automate temp permissions with required chmod a=rwx,o+t:

$ ls -ald /hab/svc/compliance-service/var/tmp
drwxrwxrwt 3 hab hab 4096 Mar 13 17:43 /hab/svc/compliance-service/var/tmp

Example of Automate .inspec cache folder:

$ ls -ald /hab/svc/compliance-service/var/tmp/.inspec/
drwxr-xr-x 4 nobody nogroup 4096 Jan 7 18:22 /hab/svc/compliance-service/var/tmp/.inspec/ 

You'll notice the .inspec folder is owned by the nobody user, which is used by the inspec check command to cache the uploaded profile being saved to the Chef Automate 2 asset store.