Swift httpd shouldn't change root httpd user

Bug #1226346 reported by Jamie Lennox
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Object Storage (swift)
Fix Released
Undecided
Jamie Lennox
devstack
Fix Released
Undecided
Jamie Lennox

Bug Description

Currently swift when setting up for httpd runs a function it calls change_apache_user_group which changes the process runner in the main apache config file. This is a bad assumption and something that can be much more easily controlled on a per-process basis. It would also appear to be the cause of having to manipulate ownership of the apache lock file another dangerous move.

Because swift uses mod_wsgi in daemon mode we can simply provide the user at load time.

To not break devstack this will require 3 parts:

1. A patch to allow sed to replace a USER variable in swift templates.
2. A patch to swift templates to have a USER variable in the template.
3. A patch to remove the current functionality from devstack.

Changed in devstack:
assignee: nobody → Jamie Lennox (jamielennox)
Revision history for this message
Jamie Lennox (jamielennox) wrote :

Apologies to those looking at this from swift, the bug report was very much written from a devstack point of view.

To make it clearer: The way devstack is using the templates in swift requires modifying the root http config. If we change the swift templates slightly it becomes much cleaner.

Changed in swift:
assignee: nobody → Jamie Lennox (jamielennox)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to devstack (master)

Fix proposed to branch: master
Review: https://review.openstack.org/46856

Changed in devstack:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Fix proposed to branch: master
Review: https://review.openstack.org/46857

Changed in swift:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (master)

Fix proposed to branch: master
Review: https://review.openstack.org/46858

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to devstack (master)

Reviewed: https://review.openstack.org/46856
Committed: http://github.com/openstack-dev/devstack/commit/d582460147404587fbcd3a39f350109d1a04a74f
Submitter: Jenkins
Branch: master

commit d582460147404587fbcd3a39f350109d1a04a74f
Author: Jamie Lennox <email address hidden>
Date: Tue Sep 17 11:44:37 2013 +1000

    Allow replacing a user variable in a swift template

    Prepare for a change in swift templates that will have a %USER%
    variable.

    Change-Id: I611ae7f82de7f2e6a38ce3de38d0600fa8687bff
    Partial-Bug: 1226346

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (master)

Reviewed: https://review.openstack.org/46858
Committed: http://github.com/openstack/swift/commit/da78035043643d1d89efbab197803d84934e420a
Submitter: Jenkins
Branch: master

commit da78035043643d1d89efbab197803d84934e420a
Author: Jamie Lennox <email address hidden>
Date: Tue Sep 17 11:46:04 2013 +1000

    Add a user variable to templates

    This is a common configuration option and allows devstack (and others)
    to configure a mod_wsgi user to run the daemon process.

    Change-Id: Idf134b3bc6b08e3c3a80dde8830d5a4f3da5a06c
    Fixes: bug 1226346

Changed in swift:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to devstack (master)

Reviewed: https://review.openstack.org/46857
Committed: http://github.com/openstack-dev/devstack/commit/5a3d7707931186664f32b1232970e3f4f4b7526f
Submitter: Jenkins
Branch: master

commit 5a3d7707931186664f32b1232970e3f4f4b7526f
Author: Jamie Lennox <email address hidden>
Date: Tue Sep 17 11:44:05 2013 +1000

    Remove change_apache_user_group function

    This function allowed you to change the process running user for all of
    apache. This is better handled on a per-process basis.

    Change-Id: I165adc0c49fc328f34835856b49983c4e189f143
    Fixes: bug 1226346
    Fixes: bug 1225853

Changed in devstack:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to swift (feature/ec)

Fix proposed to branch: feature/ec
Review: https://review.openstack.org/48990

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to swift (feature/ec)
Download full text (17.5 KiB)

Reviewed: https://review.openstack.org/48990
Committed: http://github.com/openstack/swift/commit/175a837befd57b520e28623f0d708d883c023532
Submitter: Jenkins
Branch: feature/ec

commit 4c4a8abaa500d0d3940d81a4eb5ac21215ddc07a
Author: Kun Huang <email address hidden>
Date: Fri Sep 27 15:25:53 2013 +0800

    improve bulk document

    This a very small change which just tell users request url of bulk
    delete request. In original docstrings, it just states the request
    parameters, request body and request method but not request url.

    Change-Id: I0bbc302a0e072910bb58e4814614d7f761433b10

commit df39602c41605c4c68a47c6532a466ccc1a6633d
Author: David Goetz <email address hidden>
Date: Thu Sep 12 07:38:23 2013 -0700

    bulk delete bug with trailing whitespace

    Change-Id: Ia48224a1a187a8ed6b0c9a3c72cac06f084a6fc8

commit d8e0492ea80adae990f35930465d6e905a3be061
Author: Samuel Merritt <email address hidden>
Date: Tue Aug 27 18:00:04 2013 -0700

    Fix internal swift.source tracking.

    In 1.8.0 (Grizzly), your proxy logs would indicate which middleware
    was responsible for an internal request, e.g. TU for tempurl or BD for
    bulk delete. At some point, those all turned into GET_INFO, which does
    not give you any idea which specific middleware was responsible, only
    that it came from a get_account_info/get_container_info call.

    This commit puts it back to how it was in 1.8.0. Also, the
    new-since-1.8.0 function get_object_info() got swift_source plumbing
    added to it, so source tracking for the quota middlewares'
    get_object_info() calls will happen now too.

    Note that due to the new-since-1.8.0 in-environment caching of
    account/container info, you may not see as many lines in the proxy log
    as you would with 1.8.0. This is because there are actually fewer
    internal requests being made.

    Change-Id: I2b2ff7823c612dc7ed7f268da979c4500bbbe911

commit d9d7b2135a7020cdf43172ea4fcf0b1020f49101
Author: Samuel Merritt <email address hidden>
Date: Tue Sep 24 16:43:33 2013 -0700

    Install libffi-dev in SAIO docs.

    If you don't, then newer versions of xattr won't install, and since
    our xattr requirement is simply ">= 0.4" in requirements.txt, this
    affects anyone setting up a new SAIO.

    This happened with xattr 0.7, which was released on 2013-07-19.

    Change-Id: Iaf335fa25a2908953d1fd218158ebedf5d01cc27

commit ce5e810fed8c453f4cd41c3c32162f47cde48f10
Author: Samuel Merritt <email address hidden>
Date: Tue Sep 24 16:20:28 2013 -0700

    Update SAIO doc to have double proxy-logging in pipeline.

    Change-Id: I0a034ca1420761cbf4e35dcea1d9cd18a92f90bd

commit 3e6f9293b8882cecb151e87fe5bfbe24e605b847
Author: Brian D. Burns <email address hidden>
Date: Thu Aug 1 14:50:03 2013 -0400

    update SLO delete error handling

    * ensure all responses are 200 OK
    * report missing sub-SLO manifests or other error messages in bulk
      delete response

    Change-Id: Iaf88c94bc7114ff3c9751f9f31f8f748de911f8a

commit 92ae497800d9e66795346019cf284026a751597e
Author: ZhiQiang Fan <email address hidden>
Date: Fri Sep 20 23:34:06 201...

Thierry Carrez (ttx)
Changed in swift:
milestone: none → 1.10.0-rc1
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in swift:
milestone: 1.10.0-rc1 → 1.10.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.