Ubuntu
cloud-init package

Jammy: netplan permissions warnings

Bug #2053157 reported by Chad Smith
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
cloud-init (Ubuntu)
Fix Released
High
Chad Smith
Jammy
Fix Released
Undecided
Unassigned

Bug Description

Changes in netplan.io 0.106.1-7 added warnings about invalid permissions (too open) on netplan config files. Because cloud-init defaults to 644 perms on /etc/netplan/50-cloud-init.yaml any user on an Ubuntu Jammy system with netplan will experience the following warnings when running netplan apply:

** (generate:2203): WARNING **: 19:35:37.052: Permissions for /etc/netplan/50-cloud-init.yaml are too open. Netplan configuration should NOT be accessible by others.
WARNING:root:Cannot call Open vSwitch: ovsdb-server.service is not running.

** (process:2201): WARNING **: 19:35:37.209: Permissions for /etc/netplan/50-cloud-init.yaml are too open. Netplan configuration should NOT be accessible by others.

** (process:2201): WARNING **: 19:35:37.322: Permissions for /etc/netplan/50-cloud-init.yaml are too open. Netplan configuration should NOT be accessible by others.

** (process:2201): WARNING **: 19:35:37.322: Permissions for /etc/netplan/50-cloud-init.yaml are too open. Netplan configuration should NOT be accessible by others.

cloud-init packaging in Jammy should emit root read-only netplan config files to align with this change in behavior that was introduced in netplan.io publication to the -updates pocket.

Related to bug filed against subiquity https://bugs.launchpad.net/subiquity/+bug/2052524.

Chad Smith (chad.smith)
Changed in cloud-init (Ubuntu):
importance: Undecided → High
Revision history for this message
Chad Smith (chad.smith) wrote :

Upstream project packaging fix https://github.com/canonical/cloud-init/pull/4883 in progress.

Changed in cloud-init (Ubuntu):
status: New → In Progress
assignee: nobody → Chad Smith (chad.smith)
Revision history for this message
Chad Smith (chad.smith) wrote :

Only target this at Jammy as cloud-init's mantic package already has a setting asserting NETPLAN_CONFIG_ROOT_READ_ONLY = True in cloudinit.features python module

Changed in cloud-init (Ubuntu Jammy):
status: New → Fix Released
status: Fix Released → In Progress
Changed in cloud-init (Ubuntu Mantic):
status: New → Fix Released
no longer affects: cloud-init (Ubuntu Mantic)
Revision history for this message
Chad Smith (chad.smith) wrote :

Planned for cloud-init release 24.1.

Revision history for this message
Chad Smith (chad.smith) wrote :

upstream project PR merged that will fix this in the next cloud-init SRU of version 24.1
https://github.com/canonical/cloud-init/pull/4883

Changed in cloud-init (Ubuntu Jammy):
status: In Progress → Fix Committed
Changed in cloud-init (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Changing jammy status to "in progress", because it's still in unapproved.

Changed in cloud-init (Ubuntu Jammy):
status: Fix Committed → In Progress
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

This is missing the SRU template, or clarification whether the test plan of the main SRU bug at #2056100 covers this change here.

Normally, called-out bugs in d/changelog need to have the SRU template filled in.

Revision history for this message
James Falcon (falcojr) wrote :

We intend this bug to be included in the SRU covered by https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/2056100 . Any testing related to this bug will be included there.

Revision history for this message
Andreas Hasenack (ahasenack) wrote : Please test proposed package

Hello Chad, or anyone else affected,

Accepted cloud-init into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cloud-init/24.1.3-0ubuntu1~22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in cloud-init (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-jammy
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 24.1.3-0ubuntu1~22.04.1

---------------
cloud-init (24.1.3-0ubuntu1~22.04.1) jammy; urgency=medium

  * Upstream snapshot based on 24.1.3. (LP: #2056100).
    List of changes from upstream can be found at
    https://raw.githubusercontent.com/canonical/cloud-init/24.1.3/ChangeLog

cloud-init (24.1.2-0ubuntu1~22.04.1) jammy; urgency=medium

  * refresh patches:
    - d/p/retain-ec2-default-net-update-events.patch
  * Upstream snapshot based on 24.1.2. (LP: #2056100).
    List of changes from upstream can be found at
    https://raw.githubusercontent.com/canonical/cloud-init/24.1.2/ChangeLog

cloud-init (24.1.1-0ubuntu1~22.04.1) jammy; urgency=medium

  * d/apport-general-hook.py: Move apport hook to main branch
  * d/cloud-init.maintscript: remove /etc/cloud/clean.d/README
  * d/cloud-init.logrotate: add logrotate config for cloud-init
  * d/cloud-init.templates: enable WSL datasource by default
  * Drop d/p/retain-netplan-world-readable.patch:
    - Limit perms to 600 of /etc/netplan/50-cloud-init.yaml instead of 644
      (LP: #2053157)
  * d/p/keep-dhclient-as-priority-client.patch:
    - keep dhclient as default client
  * d/p/revert-551f560d-cloud-config-after-snap-seeding.patch
    - Retain systemd ordering cloud-config.service After=snapd.seeded.service
  * d/p/retain-ec2-default-net-update-events.patch:
    Reverts 4dbb08f5f0cc4f41cf9dd1474f0600a11510a3c9 to not change behavior
    on stable releases.
  * d/po/templates.pot: update for wsl
  * d/cloud-init.postinst: change priority of hotplug rules.
    Avoids LP #1946003 on upgraded systems. References:
    [0] https://github.com/canonical/cloud-init/pull/4799
    [1] commit/b519d861aff8b44a0610c176cb34adcbe28df144
  * refresh patches:
    - d/p/status-do-not-remove-duplicated-data.patch
    - d/p/status-retain-recoverable-error-exit-code.patch
  * Upstream snapshot based on 24.1.1. (LP: #2056100).
    List of changes from upstream can be found at
    https://raw.githubusercontent.com/canonical/cloud-init/24.1.1/ChangeLog

 -- James Falcon <email address hidden> Wed, 27 Mar 2024 08:36:38 -0500

Changed in cloud-init (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

As explained in https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/2053157/comments/7, the testing was conducted in the main SRU bug. I'll flip the tags accordingly.

tags: added: verification-done-jammy
removed: verification-needed-jammy
Revision history for this message
Chad Smith (chad.smith) wrote :

Just because tags show verification needed. I ran through and validated the netplan on jammy has right limited perms as root-rw and no warnings emitted by netplan apply due to permissions

## test logs
csmith@midtown:~$ lxc launch ubuntu-daily:jammy t-j
Creating t-j
Starting t-j
csmith@midtown:~$ lxc exec t-j -- cloud-init status --wait --format=yaml
---
_schema_version: '1'
boot_status_code: enabled-by-generator
datasource: lxd
detail: DataSourceLXD
errors: []
extended_status: done
init:
    errors: []
    finished: 1714400907.8807135
    recoverable_errors: {}
    start: 1714400907.4610379
init-local:
    errors: []
    finished: 1714400906.754673
    recoverable_errors: {}
    start: 1714400906.4037504
last_update: Mon, 29 Apr 2024 14:28:33 +0000
modules-config:
    errors: []
    finished: 1714400913.6523855
    recoverable_errors: {}
    start: 1714400913.5117085
modules-final:
    errors: []
    finished: 1714400913.9227617
    recoverable_errors: {}
    start: 1714400913.8417974
recoverable_errors: {}
schemas:
    '1':
        boot_status_code: enabled-by-generator
        datasource: lxd
        detail: DataSourceLXD
        errors: []
        extended_status: done
        init:
            errors: []
            finished: 1714400907.8807135
            recoverable_errors: {}
            start: 1714400907.4610379
        init-local:
            errors: []
            finished: 1714400906.754673
            recoverable_errors: {}
            start: 1714400906.4037504
        last_update: Mon, 29 Apr 2024 14:28:33 +0000
        modules-config:
            errors: []
            finished: 1714400913.6523855
            recoverable_errors: {}
            start: 1714400913.5117085
        modules-final:
            errors: []
            finished: 1714400913.9227617
            recoverable_errors: {}
            start: 1714400913.8417974
        recoverable_errors: {}
        stage: null
        status: done
stage: null
status: done
...

csmith@midtown:~$ echo $?
0
csmith@midtown:~$ lxc exec t-j -- ls -ltr /etc/netplan/50-cloud-init.yaml
-rw------- 1 root root 389 Apr 29 14:28 /etc/netplan/50-cloud-init.yaml
csmith@midtown:~$ lxc exec t-j -- netplan apply
WARNING:root:Cannot call Open vSwitch: ovsdb-server.service is not running.
csmith@midtown:~$ lxc exec t-j -- cloud-init --version
/usr/bin/cloud-init 24.1.3-0ubuntu1~22.04.1

tags: added: verification-done
removed: verification-needed
Changed in cloud-init (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.