leaves policy-rc.d without exit 0 leading to cron sending mail

[Thomas Goirand]

Because openstacklib doesn't define a default behavior, we get mail every day from logrotate:

/etc/cron.daily/logrotate:
invoke-rc.d: policy-rc.d query returned "behaviour undefined",
invoke-rc.d: assuming "rotate" is allowed.
invoke-rc.d: policy-rc.d query returned "behaviour undefined",
invoke-rc.d: assuming "rotate" is allowed.

Exit status codes are defined like this:
  0 - action allowed
  1 - unknown action (therefore, undefined policy)
 100 - unknown initscript id
 101 - action forbidden by policy
 102 - subsystem error
 103 - syntax error
 104 - [reserved]
 105 - behaviour uncertain, policy undefined.
 106 - action not allowed. Use the returned fallback actions
       (which are implied to be "allowed") instead.

Though in one of my installation (Rocky), I can see:

# cat /usr/sbin/policy-rc.d
#!/bin/bash
# THIS FILE MANAGED BY PUPPET
[[ "$1" == "keystone" ]] && exit 101
[[ "$1" == "apache2" ]] && exit 101
[[ "$1" == "nova-api" ]] && exit 101

with a missing "exit 0", leading to the undefined behavior logged by logrotate above.

Another thing is how policy-rc.d is installed. The specifications for policy-rc.d is written here:

https://people.debian.org/~hmh/invokerc.d-policyrc.d-specification.txt

In there, it says:

"The /usr/sbin/policy-rc.d file *must* be managed through the alternatives system (/usr/sbin/update-alternatives) by any packages providing it."

so one thing puppet-openstacklib *must* do is use update-alternatives to install /usr/sbin/policy-rc.d. And it currently doesn't.

[Takashi Kajinami (kajinamit)]

This was fixed by https://review.opendev.org/c/openstack/puppet-openstacklib/+/847671