package reporter log and lock created with wrong ownership when using repository profiles

[Andreas Hasenack]

If you accept into landscape a computer with a tag, and that tag is associated with a repository profile, the following happens:

- two activities are queued: pending computer and apply repository profile

- on the client, the package reporter runs as root and creates the following two files with root ownership:

 /var/log/landscape/package-reporter.log
 /var/lib/landscape/client/package/reporter.lock
 /var/lib/landscape/client/package/smart-update-stamp

- subsequent runs of the package reporter fail:
 ==> monitor.log <==
2011-06-30 14:01:19,040 WARNING [MainThread] Package reporter output:
Traceback (most recent call last):
  File "/usr/bin/landscape-package-reporter", line 10, in <module>
    main(sys.argv[1:])
  File "/usr/lib/python2.5/site-packages/landscape/package/reporter.py", line 615, in main
    return run_task_handler(PackageReporter, args)
  File "/usr/lib/python2.5/site-packages/landscape/package/taskhandler.py", line 246, in run_task_handler
    lock_path(lock_filename)
  File "/usr/lib/python2.5/site-packages/landscape/lib/lock.py", line 11, in lock_path
    fd = os.open(path, os.O_CREAT)
OSError: [Errno 13] Permission denied: '/var/lib/landscape/client/package/reporter.lock'

As a result, no package is ever reported back to landscape.

If I accept the computer without the tag that triggers the repository profile activity, the package reporter files are created with "landscape" as their owner and everything works.

client version 11.06~bzr338-0ubuntu0.8.04

[Andreas Hasenack (ahasenack)]

I'm marking this as "high" because there is no way for the client to fix itself once it gets into this situation.

[Andreas Hasenack (ahasenack)]

This is the process tree showing it happening:

root 7697 0.2 1.8 11816 7008 ? S 14:07 0:00 /usr/bin/python /usr/bin/landscape-client --daemon --pid-file /var/run/landscape/landscape-client.
105 7700 0.5 2.8 32544 11156 ? S 14:07 0:00 \_ /usr/bin/python /usr/bin/landscape-broker --ignore-sigint --quiet
root 7712 0.5 2.5 29344 9836 ? S 14:07 0:00 \_ /usr/bin/python /usr/bin/landscape-manager --ignore-sigint --quiet
root 7781 15.0 2.0 10684 7976 ? S 14:08 0:00 | \_ /usr/bin/python /usr/bin/landscape-package-reporter --force-smart-update
105 7716 0.6 2.7 13844 10728 ? S 14:07 0:00 \_ /usr/bin/python /usr/bin/landscape-monitor --ignore-sigint --quiet

[Andreas Hasenack (ahasenack)]

This is the process tree when there is no repository profile being delivered together with the registration:

root 7995 0.2 1.8 11812 7008 ? S 14:10 0:00 /usr/bin/python /usr/bin/landscape-client --daemon --pid-file /var/run/landscape/landscape-client.
105 7997 0.5 2.7 32540 10784 ? S 14:10 0:00 \_ /usr/bin/python /usr/bin/landscape-broker --ignore-sigint --quiet
root 8010 0.4 2.5 29348 9784 ? S 14:10 0:00 \_ /usr/bin/python /usr/bin/landscape-manager --ignore-sigint --quiet
105 8014 0.5 2.7 13844 10724 ? S 14:10 0:00 \_ /usr/bin/python /usr/bin/landscape-monitor --ignore-sigint --quiet
105 8106 5.0 2.0 10968 8052 ? S 14:11 0:00 \_ /usr/bin/python /usr/bin/landscape-package-reporter --quiet

[Andreas Hasenack (ahasenack)]

The problem doesn't happen if I don't delete the smart cache and config (/var/lib/smart/*) before each run.

So:
- if I start the test with a completely new system, it breaks when repository profiles are involved.
- if I then wipe /var/lib/landscape/* and register again, with the same tag that triggers the repository profile activity, the problem doesn't happen

[Andreas Hasenack (ahasenack)]

Ignore that last comment, it doesn't make much sense and now that didn't happen in another attempt.

[Clint Byrum (clint-fewbar)]

Hello Andreas, or anyone else affected,

Accepted landscape-client into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Andreas Hasenack (ahasenack)]

Verified with landscape-client-11.07.1.1-0ubuntu0.10.04.0 from proposed:

root@ls1-lucid:~# apt-cache policy landscape-client
landscape-client:
  Installed: 11.07.1.1-0ubuntu0.10.04.0
  Candidate: 11.07.1.1-0ubuntu0.10.04.0
  Version table:
 *** 11.07.1.1-0ubuntu0.10.04.0 0
        500 http://us.archive.ubuntu.com/ubuntu/ lucid-proposed/main Packages
        100 /var/lib/dpkg/status
     11.02-0ubuntu0.10.04.1 0
        500 http://security.ubuntu.com/ubuntu/ lucid-updates/main Packages
     1.5.0.1-0ubuntu0.10.04.0 0
        500 http://us.archive.ubuntu.com/ubuntu/ lucid/main Packages

Permissions are correct in the scenario described by this bug:

root@ls1-lucid:~# ls -la /var/log/landscape/package-reporter.log /var/lib/landscape/client/package/reporter.lock /var/lib/landscape/client/package/smart-update-stamp
-rwx------ 1 landscape landscape 0 2011-07-27 21:44 /var/lib/landscape/client/package/reporter.lock
-rw-r--r-- 1 landscape landscape 0 2011-07-27 21:47 /var/lib/landscape/client/package/smart-update-stamp
-rw------- 1 landscape landscape 1331 2011-07-27 21:47 /var/log/landscape/package-reporter.log

[Martin Pitt (pitti)]

Hello Andreas, or anyone else affected,

Accepted landscape-client into maverick-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Martin Pitt (pitti)]

Hello Andreas, or anyone else affected,

Accepted landscape-client into natty-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Andreas Hasenack (ahasenack)]

Verified with the proposed packages from Maverick and Natty that the permissions and ownership of the mentioned files in /var/log/landscape and /var/lib/landscape/client/package are correct.