changer calls reporter without switching groups, just user

Bug #388092 reported by Andreas Hasenack
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Landscape Client
Fix Released
High
Free Ekanayaka

Bug Description

The package changer calls the reporter without changing its group, just the user in case it's root. The end result is that after performing a package activity, the reporter is called as landscape:root and this now prevents our smart-update SUID root binary from running. Log below (the 19:42:23,453 messages were added by me while debugging this and are not part of the code base):

==> /var/log/landscape/manager.log <==
2009-06-16 19:42:30,505 WARNING [MainThread] Package changer output:
2009-06-16 19:42:23,357 WARNING [MainThread] Couldn't download hash=>id database: Server returned HTTP code 404
2009-06-16 19:42:23,453 WARNING [MainThread] About to run smart update: groups are: [0]
2009-06-16 19:42:23,453 WARNING [MainThread] User is: 108
2009-06-16 19:42:23,563 WARNING [MainThread] '/usr/lib/landscape/smart-update' exited with status 1 (Upon execvpe /usr/lib/landscape/smart-update ['/usr/lib/landscape/smart-update', '--after', '60'] in environment id 140695996
:Traceback (most recent call last):
  File "/usr/lib/python2.5/site-packages/twisted/internet/process.py", line 357, in __init__
    command, args, environment)
  File "/usr/lib/python2.5/site-packages/twisted/internet/process.py", line 519, in _execChild
    os.execvpe(command, args, environment)
  File "/usr/lib/python2.5/os.py", line 362, in execvpe
    _execvpe(file, args, env)
  File "/usr/lib/python2.5/os.py", line 377, in _execvpe
    func(file, *argrest)
OSError: [Errno 13] Permission denied
)
2009-06-16 19:42:29,814 INFO [MainThread] Queuing message with changes in known packages: 0 installed, 0 available, 0 available upgrades, 1 not installed, 0 not available, 0 not available upgrades.

Just to recap, the suid binary is installed as follows:
-rwsr-xr-- 1 root landscape 13K 2009-06-16 14:55 /usr/lib/landscape/smart-update

Changed in landscape-client:
importance: Undecided → High
milestone: none → 1.3.2
Changed in landscape-client:
assignee: nobody → Free Ekanayaka (free.ekanayaka)
Changed in landscape-client:
status: New → In Progress
tags: added: review
Revision history for this message
Free Ekanayaka (free.ekanayaka) wrote :

Andreas spotted another problem, when the changer calls the reporter after some package operation has been performed, the reporter logs that:

2009-06-17 17:20:20,325 WARNING [MainThread] '/usr/lib/landscape/smart-update' exited with status 1 (error: Configuration is in readonly mode.
)

because the changer process is still locking the smart library. A call to Facade.deinit() solves the problem, I've updated the branch accordingly.

Revision history for this message
Thomas Herve (therve) wrote :

[1] Some pyflakes
landscape/package/changer.py:8: 'Deferred' imported but unused
landscape/package/tests/test_changer.py:525: local variable 'data_path' is assigned to but never used

[2] Can you add a comment before the deinit call so that we won't forget why it's there?

Thanks, +1!

Revision history for this message
Free Ekanayaka (free.ekanayaka) wrote :

[1] and [2] fixed, thanks Thomas!

Revision history for this message
Gustavo Niemeyer (niemeyer) wrote :

Looks good! +1!

tags: removed: review
Changed in landscape-client:
status: In Progress → Fix Committed
Jamu Kakar (jkakar)
tags: added: needs-testing
Revision history for this message
Free Ekanayaka (free.ekanayaka) wrote :

Tested against the 1.3.2 client packages in the Landscape PPA. The changer now successfully calls the reporter after a package activity, qa +1.

tags: removed: needs-testing
Changed in landscape-client:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.