haproxy log mount point error

[Jonathan Rosser]

Reported by hamburgler in IRC:

# NOTE(jrosser) The next task fails on Centos without this,
# an empty directory rather than a file is made and the bind mount fails
- name: Ensure empty file is availble to bind mount log socket
  file:
    state: touch
    path: "{{ haproxy_log_mount_point }}"
    access_time: preserve
    modification_time: preserve
    owner: haproxy
    group: root
    mode: "0775"

- name: Make log socket available to chrooted filesystem
  mount:
    src: "{{ haproxy_log_socket }}"
    path: "{{ haproxy_log_mount_point }}"
    opts: bind
    state: mounted
    fstype: none

On a fresh install, once the second task mounts w/ bind we get permissions:

root@openstack-networking1-canada-west-cloud:/var/lib/haproxy/dev# ls -alh
total 8.0K
drwxr-xr-x 2 haproxy haproxy 4.0K Feb 26 13:06 .
drwxr-x--- 3 haproxy haproxy 4.0K Feb 26 13:06 ..
srw-rw-rw- 1 root root 0 Feb 26 13:20 log

where haproxy can write to file because rw on other group

when haproxy-config is ran again, it will change the permissions, because of touch, as touch doesn't check to see if the file exists, we now get:

root@openstack-networking1-canada-west-cloud:/var/lib/haproxy/dev# ls -alh
total 8.0K
drwxr-xr-x 2 haproxy haproxy 4.0K Feb 26 13:06 .
drwxr-x--- 3 haproxy haproxy 4.0K Feb 26 13:06 ..
srwxrwxr-x 1 root root 0 Feb 26 13:20 log

and haproxy can no longer log to file

Feb 26 13:24:26 openstack-networking1-canada-west-cloud haproxy[2419]: [ALERT] (2419) : sendmsg()/writev() failed in logger #1: Permission denied (errno=13)

so two ways we could go about fixing:

Add a precheck:

- name: Check if haporxy log file exists
  stat:
    path: "{{ haproxy_log_mount_point }}"
  register: haproxy_log_file

# NOTE(jrosser) The next task fails on Centos without this,
# an empty directory rather than a file is made and the bind mount fails
- name: Ensure empty file is availble to bind mount log socket
  file:
    state: touch
    path: "{{ haproxy_log_mount_point }}"
    access_time: preserve
    modification_time: preserve
    mode: "0775"
  when: not haproxy_log_file.stat.exists

we could also add owner:group as well

- name: Ensure empty file is availble to bind mount log socket
  file:
    state: touch
    path: "{{ haproxy_log_mount_point }}"
    access_time: preserve
    modification_time: preserve
    owner: haproxy
    group: root
    mode: "0775"

But I think the stat makes more sense, because the "Make log socket available to chrooted filesystem" mounts with 0666 permissions, and we will always show a changed on the "Ensure empty file is available to bind mount log socket" task.

[Dmitriy Rabotyagov (noonedeadpunk)]

So, adding haproxy as an owner does very nasty thing, as it changes also ownership of /dev/log directly (as it's a bind-mount), so way more services would be affected.

To have that said, current mode change also breaks more then just haproxy...

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/910384

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/910384
Committed: https://opendev.org/openstack/openstack-ansible-haproxy_server/commit/ed981ce09ad7ea5dd82c7b620abe9ecce2c1d797
Submitter: "Zuul (22348)"
Branch: master

commit ed981ce09ad7ea5dd82c7b620abe9ecce2c1d797
Author: Dmitriy Rabotyagov <email address hidden>
Date: Tue Feb 27 19:46:08 2024 +0100

    Use correct permissions for haproxy log mount

    With [1] a regression was introduced, where incorrect permissions were
    applied to a bind mount corrupting access to /dev/log globally on hosts
    where haproxy was running.

    Default permissions are 0666 for /dev/log when it's managed by journald.

    [1] https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/888143
    Closes-Bug: #2055178

    Change-Id: Ib8b9e4dea0ecd5d35f0e872dfaa0f2ec837a98f8

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/2023.2
Review: https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/911603

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/911603
Committed: https://opendev.org/openstack/openstack-ansible-haproxy_server/commit/399a1d50b5f2d4e1f8783427eb0503eef48d789a
Submitter: "Zuul (22348)"
Branch: stable/2023.2

commit 399a1d50b5f2d4e1f8783427eb0503eef48d789a
Author: Dmitriy Rabotyagov <email address hidden>
Date: Tue Feb 27 19:46:08 2024 +0100

    Use correct permissions for haproxy log mount

    With [1] a regression was introduced, where incorrect permissions were
    applied to a bind mount corrupting access to /dev/log globally on hosts
    where haproxy was running.

    Default permissions are 0666 for /dev/log when it's managed by journald.

    [1] https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/888143
    Closes-Bug: #2055178

    Change-Id: Ib8b9e4dea0ecd5d35f0e872dfaa0f2ec837a98f8
    (cherry picked from commit ed981ce09ad7ea5dd82c7b620abe9ecce2c1d797)