The package changer calls the reporter without changing its group, just the user in case it's root. The end result is that after performing a package activity, the reporter is called as landscape:root and this now prevents our smart-update SUID root binary from running. Log below (the 19:42:23,453 messages were added by me while debugging this and are not part of the code base):
==> /var/log/landscape/manager.log <==
2009-06-16 19:42:30,505 WARNING [MainThread] Package changer output:
2009-06-16 19:42:23,357 WARNING [MainThread] Couldn't download hash=>id database: Server returned HTTP code 404
2009-06-16 19:42:23,453 WARNING [MainThread] About to run smart update: groups are: [0]
2009-06-16 19:42:23,453 WARNING [MainThread] User is: 108
2009-06-16 19:42:23,563 WARNING [MainThread] '/usr/lib/landscape/smart-update' exited with status 1 (Upon execvpe /usr/lib/landscape/smart-update ['/usr/lib/landscape/smart-update', '--after', '60'] in environment id 140695996
:Traceback (most recent call last):
File "/usr/lib/python2.5/site-packages/twisted/internet/process.py", line 357, in __init__
command, args, environment)
File "/usr/lib/python2.5/site-packages/twisted/internet/process.py", line 519, in _execChild
os.execvpe(command, args, environment)
File "/usr/lib/python2.5/os.py", line 362, in execvpe
_execvpe(file, args, env)
File "/usr/lib/python2.5/os.py", line 377, in _execvpe
func(file, *argrest)
OSError: [Errno 13] Permission denied
)
2009-06-16 19:42:29,814 INFO [MainThread] Queuing message with changes in known packages: 0 installed, 0 available, 0 available upgrades, 1 not installed, 0 not available, 0 not available upgrades.
Just to recap, the suid binary is installed as follows:
-rwsr-xr-- 1 root landscape 13K 2009-06-16 14:55 /usr/lib/landscape/smart-update
Andreas spotted another problem, when the changer calls the reporter after some package operation has been performed, the reporter logs that:
2009-06-17 17:20:20,325 WARNING [MainThread] '/usr/lib/ landscape/ smart-update' exited with status 1 (error: Configuration is in readonly mode.
)
because the changer process is still locking the smart library. A call to Facade.deinit() solves the problem, I've updated the branch accordingly.