security.py needs to be smarter

[Stuart Bishop]

security.py should be smarter and only change permissions when it needs to,
rather than its current method of resetting everything and rebuilding from
scratch. This would make it possible to run the script against a live
database in most cases

 affects /products/launchpad
 assignee stub
 status confirmed

--
Stuart Bishop <email address hidden> http://www.canonical.com/
Canonical Ltd. http://www.ubuntu.com/

[Stuart Bishop (stub)]

This causes an outage of the login servers during upgrades.

security.py revokes all permissions and then resets then per config. This creates a window where the login servers do not have permission to read the tables they need to.

[Tom Haddon (mthaddon)]

This is a virtual necessity now, especially given the drive towards continuous rollout. It has bitten us most recently with https://wiki.canonical.com/IncidentReports/2010-10-12-Branching-Ubuntu

[Launchpad QA Bot (lpqabot)]

Fixed in db-stable r9977 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/db-stable/revision/9977>.

[Tom Haddon (mthaddon)]

Is this a new option, or something that just happens automatically? Just wondering how we can apply this/test.

[Robert Collins (lifeless)]

Its a new option - we can test it on qastaging: make the automatic
deploys run the --norevoke version only, and at the monthly deploy run
the full version when we test the full database patch story.

[Launchpad QA Bot (lpqabot)]

Fixed in db-stable r9984 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/db-stable/revision/9984>.

[Stuart Bishop (stub)]

So to be clear:
 - Update code on database host
 - Run security.py --no-revoke
 - Update code on the rest of the systems

By granting the new permissions and not revoking old permissions, we no longer have a window where database permissions do not patch permissions required by running code.

If we want, after the update we can run normal security.py to revoke permissions that should no longer be needed, but I don't think this gains us anything and just makes it more likely to shoot ourselves in the foot.

[Gary Poster (gary)]

Thank you Stuart. Have you called the LOSAs' attention to this? Alternatively, can a LOSA ack Stuart's message?