haproxy misconfiguration lead to missing logs

[Sergey Yudin]

Haproxy backends is configured to log http reqs and haproxy logger is logging onto /dev/log, but since haproxy is running in chroot(not namespace!) haproxy can't log into system /dev/log.

Proposed solution:
remove line
chroot /var/lib/haproxy
from haproxy.cfg since there is no obvious reasons to run haproxy in the chroot.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/110996

[Dmitry Borodaenko (angdraug)]

As commented on the review, I think a better solution is to expose /dev/log inside the chroot (e.g. bindmount /dev into it) instead of disabling a valuable security isolation measure.

[Sergey Yudin (tsipa740)]

Otherwise we have to deal with syslog to let them know about new source, or use some hacky solution with symlinks or something. Also the only reason to use chroot here i heard was "it was enabled by default".

[Dmitry Borodaenko (angdraug)]

Well, chroot is supposed to be a security measure, but after some more reading on the topic, I'm ready to concede that it's really not, especially if the whole /dev/ is bindmounted into the jail.

[Vladimir Kuklin (vkuklin)]

we can symlink only /dev/log

[Sergey Yudin (tsipa740)]

No, i don't think we can solve the issue with symlink, it just will not work. The only _proper_ solution is to use another socket in the chroot and notify syslog about new log source.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/110996
Committed: https://git.openstack.org/cgit/stackforge/fuel-library/commit/?id=9877025db8b5f90ca0ebeb342cdce5741bc1d943
Submitter: Jenkins
Branch: master

commit 9877025db8b5f90ca0ebeb342cdce5741bc1d943
Author: Bogdan Dobrelya <email address hidden>
Date: Thu Jul 31 18:33:28 2014 +0300

    Do not run haproxy in chroot

    Chroot prevents haproxy from logging into /dev/log
    and that is an issue. There is no need to run
    it in chroot as well.

    Closes-bug: #1350835

    Change-Id: Ib161fced734344815035b4ddfcf28bfda11a0cb7
    Signed-off-by: Bogdan Dobrelya <email address hidden>