Template files are rendered 640 root:root and cuase services to fail

[David Ames]

Something has changed in either reactive or charms.openstack or charm-helpers that causes template files to be written with 640 root:root permissions.

This causes OpenStack daemons to fail to be able to read these files:

Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: Traceback (most recent call last):
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: File "/usr/bin/aodh-listener", line 10, in <module>
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: sys.exit(listener())
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: File "/usr/lib/python2.7/dist-packages/aodh/cmd/alarm.py", line 43, in listener
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: conf = service.prepare_service()
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: File "/usr/lib/python2.7/dist-packages/aodh/service.py", line 87, in prepare_service
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: default_config_files=config_files)
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: File "/usr/lib/python2.7/dist-packages/oslo_config/cfg.py", line 2355, in __call__
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: self._namespace._files_permission_denied)
Jul 18 22:48:52 juju-14fa71-thedac-6 aodh-listener[22072]: oslo_config.cfg.ConfigFilesPermissionDeniedError: Failed to open some config files: /etc/aodh/aodh.conf
Jul 18 22:48:53 juju-14fa71-thedac-6 systemd[1]: aodh-listener.service: Main process exited, code=exited, status=1/FAILURE
Jul 18 22:48:53 juju-14fa71-thedac-6 systemd[1]: aodh-listener.service: Unit entered failed state.
Jul 18 22:48:53 juju-14fa71-thedac-6 systemd[1]: aodh-listener.service: Failed with result 'exit-code'.
Jul 18 22:48:53 juju-14fa71-thedac-6 systemd[1]: aodh-listener.service: Service hold-off time over, scheduling restart.

I am adding aodh and neutron-dynamic-routing as targets but the fault will affect all reactive charms and likely lies outside of the charms themselves.

[Liam Young (gnuoy)]

https://review.openstack.org/#/c/582755/ is the cause. I think its correct to have the permissions locked down and to only open them up as required. I'll take a look at aodh now.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/583937

[Ryan Beisner (1chb1n)]

I agree. Let's use this as a driver to evaluate permissions on files to ensure only the minimal necessary ownership/perms are declared.

[David Ames (thedac)]

Due to intentional change to tighten permissions: https://github.com/openstack/charms.openstack/commit/51d00c45e2e3b1f25513ce4f90f35007bac15fc9

Add properties to the class to resolve:

class MyCharm(charms_openstack.charm.OpenStackCharm):
    user = 'myuser'
    group = 'mygroup'

For charms that use modwisgi also change the user/group in the WSGI setup similar to:
https://github.com/openstack/charm-gnocchi/commit/bc1745115b6a9c7837075a4353d60a1e5a1e2ca9

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/583704
Committed: https://git.openstack.org/cgit/openstack/charm-neutron-dynamic-routing/commit/?id=ba7b42e36c1d527433852e3fbb93b64248b9f9b7
Submitter: Zuul
Branch: master

commit ba7b42e36c1d527433852e3fbb93b64248b9f9b7
Author: David Ames <email address hidden>
Date: Wed Jul 18 12:04:10 2018 -0700

    Use the provider network for router id

    The router id for the dragent must be on the provider network. The
    charm was using the BGP speaker_ip which is only used for related
    test services. (i.e. quagga).

    This change guarantees the router id uses the provider extra binding
    IP.

    It also sets the group ownership to neutron for rendered config files.

    Closes-Bug: #1782433
    Partial-Bug: #1782444
    Change-Id: I4761b4c5b80a398e13e4cdf880b773df489f53b9

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/18.05
Review: https://review.openstack.org/584483

[OpenStack Infra (hudson-openstack)]

Change abandoned by Liam Young (<email address hidden>) on branch: master
Review: https://review.openstack.org/583937
Reason: Looks like someone ignored my patch and landed their own https://pastebin.canonical.com/p/DzrFvRsDgT/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/584483
Committed: https://git.openstack.org/cgit/openstack/charm-neutron-dynamic-routing/commit/?id=50014ed7147210ec89b8a9f29e1dd7c0c70b0b1d
Submitter: Zuul
Branch: stable/18.05

commit 50014ed7147210ec89b8a9f29e1dd7c0c70b0b1d
Author: David Ames <email address hidden>
Date: Wed Jul 18 12:04:10 2018 -0700

    Use the provider network for router id

    The router id for the dragent must be on the provider network. The
    charm was using the BGP speaker_ip which is only used for related
    test services. (i.e. quagga).

    This change guarantees the router id uses the provider extra binding
    IP.

    It also sets the group ownership to neutron for rendered config files.

    cherry picked from commit ba7b42e36c1d527433852e3fbb93b64248b9f9b7

    Closes-Bug: #1782433
    Partial-Bug: #1782444
    Change-Id: I4761b4c5b80a398e13e4cdf880b773df489f53b9