juju scp giving permission errors for lxd models

[Pietro Pasotti]

juju scp ./foo.txt ubuntu/0:/var/foo.txt fails with Permission denied on LXD, but it passes on microk8s models.

Output with `--debug`:

❯ j scp --debug ./juju_mongo_ssh.sh ubuntu/0:/var/crpc_mod.py
13:06:57 INFO juju.cmd supercommand.go:56 running juju [3.1.7 0cd207d999fef1fc8b965c410e9f58fafe7ee335 gc go1.21.4]
13:06:57 DEBUG juju.cmd supercommand.go:57 args: []string{"/snap/juju/25751/bin/juju", "scp", "--debug", "./juju_mongo_ssh.sh", "ubuntu/0:/v
}
13:06:57 INFO juju.juju api.go:86 connecting to API addresses: [[fd42:8f51:586c:99c6:216:3eff:fe87:1618]:17070 10.187.66.92:17070]
13:06:57 DEBUG juju.api apiclient.go:1172 successfully dialed "wss://[fd42:8f51:586c:99c6:216:3eff:fe87:1618]:17070/model/1ae56a68-7026-45c4-8
2/api"
13:06:57 INFO juju.api apiclient.go:707 connection established to "wss://[fd42:8f51:586c:99c6:216:3eff:fe87:1618]:17070/model/1ae56a68-7026-4
c10e52/api"
13:06:57 DEBUG juju.cmd.juju.ssh ssh_machine.go:344 proxy-ssh is false
13:06:57 DEBUG juju.network.ssh reachable.go:156 dialing [fd42:8f51:586c:99c6:216:3eff:fe02:1e8b]:22 to check host keys
13:06:57 DEBUG juju.network.ssh reachable.go:156 dialing 10.187.66.124:22 to check host keys
13:06:57 DEBUG juju.network.ssh reachable.go:169 connected to [fd42:8f51:586c:99c6:216:3eff:fe02:1e8b]:22, initiating ssh handshake
13:06:57 DEBUG juju.network.ssh reachable.go:169 connected to 10.187.66.124:22, initiating ssh handshake
13:06:57 DEBUG juju.network.ssh reachable.go:98 accepted host key for: 10.187.66.124:22
13:06:57 DEBUG juju.network.ssh reachable.go:98 accepted host key for: [fd42:8f51:586c:99c6:216:3eff:fe02:1e8b]:22
13:06:57 INFO juju.network.ssh reachable.go:223 found 10.187.66.124:22 has an acceptable ssh key
13:06:57 DEBUG juju.cmd.juju.ssh ssh_machine.go:494 using target "ubuntu/0" address "10.187.66.124"
13:06:57 DEBUG juju.network.ssh reachable.go:181 ssh: handshake failed: host key was accepted, but search was stopped
13:06:57 DEBUG juju.utils.ssh ssh.go:311 using OpenSSH ssh client
13:06:57 DEBUG juju.api monitor.go:35 RPC connection died
ERROR exit status 1 (scp: /var/crpc_mod.py: Permission denied)
13:06:57 DEBUG cmd supercommand.go:528 error stack:
github.com/juju/utils/v3/ssh.(*OpenSSHClient).Copy:172: exit status 1 (scp: /var/crpc_mod.py: Permission denied)

[Joseph Phillips (manadart)]

Is /var/crpc_mod.py accessible by the ubuntu user?

[Pietro Pasotti (ppasotti)]

if you're asking whether the ubuntu user has read rights to /var, I think the answer is no and that is indeed the underlying problem here.
After a discussion with jameinel the source of my issue/confusion is that the scp command succeeds in kubernetes models, but fails on lxd. I was expecting to see it work on lxd too, but turns out it shouldn't work on kubernetes either. The 'bug' is therefore that `juju scp app/0 foo /var/bar` behaves inconsistently across model types.

[Launchpad Janitor (janitor)]

[Expired for Canonical Juju because there has been no activity for 60 days.]