nova-agent versions 0.0.28 to 0.0.31 write /etc/resolv.conf with wrong permissions

[James Glenn]

-rw------- 1 root root 293 Nov 11 09:17 /etc/resolv.conf

Is how the file gets written.

Needs to be:

-rw-r--r-- 1 root root 293 Nov 11 09:17 /etc/resolv.conf

[James Glenn (james-glenn)]

If the file already exists with the correct permissions, the permissions are not changed.

[Chris Behrens (cbehrens)]

The agent does not re-write /etc/resolv.conf for redhat/centos. For other distros, it creates files always with 0644 permissions.
Base images will need to have a /etc/resolv.conf in them with the permissions you desire...

[BK Box (bkbox)]

If the file happens to not exist and the agent writes it, it should create it with the correct permissions.

[Chris Behrens (cbehrens)]

It does.

[BK Box (bkbox)]

From looking at the code, it appears that the redhat portion of network.py will update the per device information with the DNS data in the form of "DNS=x.x.x.x". Although, I am not seeing that in our eth0 files:

# cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
IPADDR=x.x.x.x
NETMASK=255.255.255.0
ONBOOT=yes

When the instance is created, there is no /etc/resolv.conf, but the file is still created even though there is no DNS= information. This file is created with 600 perms:

# ls -l /etc/resolv.conf
-rw------- 1 root root 46 Nov 18 15:10 /etc/resolv.conf

If the code is falling back to the update_files, I see where it chmod's to 644, but the resolv.conf file does not reflect that.

Please help me understand if I am looking at the code incorrectly.

[Johannes Erdfelt (johannes.erdfelt)]

I think you're making an assumption that nova-agent is creating that /etc/resolv.conf. Are you sure it didn't exist already before nova-agent is run?

nova-agent should add entries in the form of DNS%d=%s to the ifcfg-interface script, but only if there is DNS information supplied to the resetnetwork command.

I just confirmed and the code added a DNS1= line for me on RHEL.

[BK Box (bkbox)]

Yes, I am sure the files do not exist, (We have since added the file to the image so it will build correctly) but there is no sign of DNS variables in any configuration file and the resolv.conf file appears with the correct information, but incorrect permissions.

[Johannes Erdfelt (johannes.erdfelt)]

Are you using file injection?

[BK Box (bkbox)]

BAM! Looks like our backend is doing that injection. Thanks for the suggestion, and sorry for the invalid bug report.