"Invalid IPC credentials" after corosync, pacemaker service restarts

[JuanJo Ciarlante]

Followup from https://bugs.launchpad.net/ubuntu/+source/pacemaker/+bug/1439649,
see there comments #14, #15 as it _maybe_ related to missing uidgid ACLs for
hacluster:haclient (as apparently presented by pacemaker).

FYI you can find relevant IPC resources with:
$ find /run/shm -user hacluster -group haclient -ls

[Billy Olsen (billy-olsen)]

The work around presented by JuanJo seems to work out reasonably well, so that may be a good path forward for the time being. However, the ACLs for pacemaker shouldn't really be enabled so something else seems likes its going on. For now, I think proposing the work around is a good thing until the percona/corosync issue is straightented out.

[JuanJo Ciarlante (jjo)]

Thanks for the quick turnaround, could you please backport the fix
to 1507 trunk ?
We have several stacks where we need to manually apply
above workaround for corosync/pacemaker to behave properly,
and several coming down the line before 1510.

FYI I while fixing hacluster trunk (essentially came out with the same
changes), had to add a line to test_hacluster_utils.py to pass unittests:
http://paste.ubuntu.com/12272628/

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Robie Basak (racb)]

Please could you complete the bug report from the perspective of the pacemaker task? I don't think there's enough here to go on for example in a way that upstream or the Debian maintainer would understand.

[Rafael David Tinoco (rafaeldtinoco)]

For pacemaker, this is a duplicate of:

https://bugs.launchpad.net/bugs/1439649

So, instead of marking it as duplicate, since it had charm work, I'm removing pacemaker from the bug and leaving this comment:

https://bugs.launchpad.net/ubuntu/+source/pacemaker/+bug/1439649/comments/20

"""
From Corosync 2.4.1 Release Notes:

This release contains fix for one regression and few more smaller fixes.

"""
During 2.3.6 development the bug which is causing pacemaker to not work after corosync configuration file is reloaded happened. Solution is ether to use this fixed version (recommended) or as a quick workaround (for users who wants to stay on 2.3.6 or 2.4.0) is to create file pacemaker (file name can be arbitrary) in /etc/corosync/uidgid.d directory with following content (you can also put same stanza into /etc/corosync/corosync.conf):

uidgid {
    gid: haclient
}
"""

Anyone relying in Trusty or Xenial corosync:

 corosync | 2.3.3-1ubuntu1 | trusty
 corosync | 2.3.3-1ubuntu4 | trusty-updates
 corosync | 2.3.5-3ubuntu1 | xenial
 corosync | 2.3.5-3ubuntu2.3 | xenial-security
 corosync | 2.3.5-3ubuntu2.3 | xenial-updates

should apply the mitigation above, like discovered previously by commenters of this bug.

Note: Trusty is already EOS so I'm marking it as "won't fix".

Xenial should include the mitigation in a SRU.
"""