The landscape client plugin doesn't create the config file with the proper permissions

Bug #1066115 reported by Thomas Herve
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
cloud-init
Fix Released
Medium
Unassigned
cloud-init (Ubuntu)
Fix Released
Medium
Unassigned
Precise
Fix Released
Medium
Unassigned
Quantal
Fix Released
Medium
Scott Moser

Bug Description

=== Begin SRU Information ===
[Impact]
 * If an image does not have landscape-client installed inside it, and the
   user provided landscape config, then:
   a.) the landscape config file would be written with root:root permissions
       so that the user that landscape runs as could not change it.
   b.) the landscape package would not be installed.

 * The fix here is just to install the landscape-client package. This is
   clearly what the user would want.
   Additionally, no package installation occurs unless the user made that
   request. The fix for 'a' is also addressed by this because the file will
   exist on disk with proper permissions before cloud-init writes it, and
   will thus keep the same ownership.

[Test Case]
 * launch instance with landscape config in user-data like the following:
   #cloud-config
   apt_upgrade: True
   apt_sources:
    - source: deb $MIRROR $RELEASE-proposed main
   landscape:
     client:
       url: "https://landscape.canonical.com/message-system"
       ping_url: "http://landscape.canonical.com/ping"
       data_path: "/var/lib/landscape/client"
       http_proxy: "http://my.proxy.com/foobar"
       tags: "server,cloud"
 * upon investigation, /etc/landscape/client.conf should be owned
   by 'landscape' user rather than root.

[Regression Potential]
 * If a user with a generic user_data setup is assuming that the 'landscape' config will be applied only on those images which already have landscape-client installed, automatically installing landscape-client will be an unexpected a behavior change.

=== End SRU Information ===

When cloud-init runs and landscape-client is not installed, it creates /etc/landscape/client.conf owned as root:root, whereas landscape-client expects it to be landscape:root. The proper fix is although probably to require installation of landscape-client first, as it will create the file properly, and then landscape-client can update it.

Related branches

Scott Moser (smoser)
Changed in cloud-init:
importance: Undecided → Medium
status: New → Triaged
Thomas Herve (therve)
description: updated
Scott Moser (smoser)
Changed in cloud-init (Ubuntu Precise):
status: New → Triaged
importance: Undecided → Medium
Changed in cloud-init (Ubuntu Quantal):
status: New → Triaged
importance: Undecided → Medium
Changed in cloud-init (Ubuntu):
status: New → Triaged
importance: Undecided → Medium
Revision history for this message
Scott Moser (smoser) wrote :
Changed in cloud-init:
status: Triaged → Fix Committed
Scott Moser (smoser)
description: updated
Scott Moser (smoser)
Changed in cloud-init:
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.7.1-0ubuntu1

---------------
cloud-init (0.7.1-0ubuntu1) raring; urgency=low

  * New upstream release.
    * landscape: install landscape-client package if not installed.
      only take action if cloud-config is present (LP: #1066115)
    * landscape: restart landscape after install or config (LP: #1070345)
    * multipart/archive: do not fail on unknown headers in multipart
      mime or cloud-archive config (LP: #1065116).
    * tools/Z99-cloud-locale-test.sh: avoid warning when user's shell is
      zsh (LP: #1073077)
    * fix stack trace when unknown user-data input had unicode (LP: #1075756)
    * split 'apt-update-upgrade' config module into 'apt-configure' and
      'package-update-upgrade-install'. The 'package-update-upgrade-install'
      will be a cross distro module.
    * fix bug where cloud-config from user-data could not affect system_info
      settings (LP: #1076811)
    * add yum_add_repo configuration module for adding additional yum repos
    * fix public key importing with config-drive-v2 datasource (LP: #1077700)
    * handle renaming and fixing up of marker names (LP: #1075980)
      this relieves that burden from the distro/packaging.
    * group config: fix how group members weren't being translated correctly
      when the group: [member, member...] format was used (LP: #1077245)
    * work around an issue with boto > 0.6.0 that lazy loaded the return from
      get_instance_metadata(). This resulted in failure for cloud-init to
      install ssh keys. (LP: #1068801)
    * add power_state_change config module for shutting down stystem after
      cloud-init finishes. (LP: #1064665)
 -- Scott Moser <email address hidden> Wed, 14 Nov 2012 15:18:50 -0500

Changed in cloud-init (Ubuntu):
status: Triaged → Fix Released
Scott Moser (smoser)
Changed in cloud-init (Ubuntu Quantal):
status: Triaged → In Progress
assignee: nobody → Scott Moser (smoser)
Steve Langasek (vorlon)
description: updated
Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello Thomas, or anyone else affected,

Accepted cloud-init into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cloud-init/0.6.3-0ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in cloud-init (Ubuntu Precise):
status: Triaged → Fix Committed
tags: added: verification-needed
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Hello Thomas, or anyone else affected,

Accepted cloud-init into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cloud-init/0.7.0-0ubuntu2.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in cloud-init (Ubuntu Quantal):
status: In Progress → Fix Committed
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Hello Thomas, or anyone else affected,

Accepted cloud-init into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cloud-init/0.7.0-0ubuntu2.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Hello Thomas, or anyone else affected,

Accepted cloud-init into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cloud-init/0.6.3-0ubuntu1.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Revision history for this message
Thomas Herve (therve) wrote :

Tested 0.6.3-0ubuntu1.3 on precise and 0.7.0-0ubuntu2.2 on quantal, both working great.

tags: added: verification-done
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.6.3-0ubuntu1.3

---------------
cloud-init (0.6.3-0ubuntu1.3) precise-proposed; urgency=low

  * debian/patches/lp-1070345-landscape-restart-after-change.patch,
    debian/patches/lp-1066115-landscape-install-fix-perms.patch:
    fix missing or incorrect imports (LP: #1070345, LP: #1066115).

cloud-init (0.6.3-0ubuntu1.2) precise-proposed; urgency=low

  * debian/patches/lp-978127-maas-oauth-fix-bad-clock.patch: fix usage of
    oauth in maas data source if local system has a bad clock (LP: #978127)
  * debian/cloud-init.preinst: fix bug where user data scripts re-ran on
    upgrade from 10.04 versions (LP: #1049146)
  * debian/patches/lp-974509-detect-dns-server-redirection.patch: detect dns
    server redirection and disable searching dns for a mirror named
    'ubuntu-mirror' (LP: #974509)
  * debian/patches/lp-1018554-shutdown-message-to-console.patch: write a
    message to the console on system shutdown. (LP: #1018554)
  * debian/patches/lp-1066115-landscape-install-fix-perms.patch: install
    landscape package if needed which will ensure proper permissions on config
    file (LP: #1066115).
  * debian/patches/lp-1070345-landscape-restart-after-change.patch: restart
    landscape after modifying config (LP: #1070345)
  * debian/patches/lp-1073077-zsh-workaround-for-locale_warn.patch: avoid
    warning when user's shell is zsh (LP: #1073077)
  * debian/patches/rework-mirror-selection.patch: improve mirror selection by:
    * allowing region/availability-zone to be part of mirror (LP: #1037727)
    * making mirror selection arch aware (LP: #1028501)
    * allow specification of a security mirror (LP: #1006963)
 -- Scott Moser <email address hidden> Thu, 13 Dec 2012 12:16:56 -0500

Changed in cloud-init (Ubuntu Precise):
status: Fix Committed → Fix Released
Revision history for this message
Colin Watson (cjwatson) wrote : Update Released

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cloud-init - 0.7.0-0ubuntu2.2

---------------
cloud-init (0.7.0-0ubuntu2.2) quantal-proposed; urgency=low

  * debian/patches/lp-1090482-fix-cloud-config-mirrors.patch:
    fix issue with cloud-config data in user-data providing mirror
    info (LP: #1073077)

cloud-init (0.7.0-0ubuntu2.1) quantal-proposed; urgency=low

  * debian/patches/lp-1073077-zsh-workaround-for-locale_warn.patch: avoid
    warning when user's shell is zsh (LP: #1073077)
  * debian/patches/lp-1077700-config-drive-fix-ssh-authorized-keys.patch:
    fix bug in config-drive-v2 usage of authoried keys (LP: #1077700)
  * debian/patches/lp-1080985-fix-resize-root-noblock.patch:
    fix 'resize_root: noblock' (LP: #1080985)
  * debian/patches/lp-1076811-fix-userdata-update-to-distro-config.patch:
    fix updates to distro config via user-data. (LP: #1076811)
  * debian/patches/lp-1066115-install-landscape-if-needed.patch:
    fix permissions on landscape config, and ensure landscape client
    is installed if landscape config is given. (LP: #1066115)
  * debian/patches/lp-1070345-restart-landscape-if-needed.patch:
    restart the landscape-client if changes to config were made. (LP: #1070345)
  * debian/patches/lp-1077020-fix-ca-certificates-blanklines.patch: fix
    adding of empty lines in ca-certificates file (LP: #1077020)
 -- Scott Moser <email address hidden> Mon, 17 Dec 2012 10:15:03 -0500

Changed in cloud-init (Ubuntu Quantal):
status: Fix Committed → Fix Released
Revision history for this message
James Falcon (falcojr) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.