ZEO default install doesn't work with the 'user zope' directive in zeo.conf

[Darryl Dixon]

Create a default install of Zope.
Run bin/mkzeoinstance.py to create a ZEO instance (as root).
Chown -R all files in the ZEO instance directory to be owned by 'zope'.
edit $INSTANCE/etc/zeo.conf and uncomment the '# user zope' directive.
Attempt to start zeo as the root user. Parent process will spin and child processes will die silently.

The problem is that the logfile ($INSTANCE/log/zeo.log) is created on the first run by the parent process, and is therefore owned by root. The child processes attempt to open the file for writing and get unhandled exception IOErrror Permission Denied (see traceback below).

Therefore, the parent process needs to create the logfile as the 'zope' user (or whatever is defined in zeo.conf).

TRACEBACK:
[zope@directender zeo]$ bin/zeoctl start
. Traceback (most recent call last):
  File "/zope/apps/zope-2.9.6/lib/python/zdaemon/zdrun.py", line 719, in ?
    main()
  File "/zope/apps/zope-2.9.6/lib/python/zdaemon/zdrun.py", line 716, in main
    d.main(args)
  File "/zope/apps/zope-2.9.6/lib/python/zdaemon/zdrun.py", line 240, in main
    self.options.realize(args)
  File "/zope/apps/zope-2.9.6/lib/python/zdaemon/zdrun.py", line 108, in realize
    RunnerOptions.realize(self, *args, **kwds)
  File "/zope/apps/zope-2.9.6/lib/python/zdaemon/zdoptions.py", line 363, in realize
    ZDOptions.realize(self, *args, **kwds)
  File "/zope/apps/zope-2.9.6/lib/python/zdaemon/zdoptions.py", line 303, in realize
    self.load_logconf(self.logsectionname)
  File "/zope/apps/zope-2.9.6/lib/python/zdaemon/zdrun.py", line 127, in load_logconf
    RunnerOptions.load_logconf(self, "eventlog")
  File "/zope/apps/zope-2.9.6/lib/python/zdaemon/zdoptions.py", line 337, in load_logconf
    obj.startup()
  File "/zope/apps/zope-2.9.6/lib/python/ZConfig/components/logger/logger.py", line 51, in startup
    self()
  File "/zope/apps/zope-2.9.6/lib/python/ZConfig/components/logger/factory.py", line 32, in __call__
    self.instance = self.create()
  File "/zope/apps/zope-2.9.6/lib/python/ZConfig/components/logger/logger.py", line 42, in create
    handler = handler_factory()
  File "/zope/apps/zope-2.9.6/lib/python/ZConfig/components/logger/factory.py", line 32, in __call__
    self.instance = self.create()
  File "/zope/apps/zope-2.9.6/lib/python/ZConfig/components/logger/handlers.py", line 69, in create
    logger = self.create_loghandler()
  File "/zope/apps/zope-2.9.6/lib/python/ZConfig/components/logger/handlers.py", line 87, in create_loghandler
    handler = loghandler.FileHandler(path)
  File "/zope/apps/zope-2.9.6/lib/python/ZConfig/components/logger/loghandler.py", line 34, in __init__
    StreamHandler.__init__(self, open(filename, mode))
IOError: [Errno 13] Permission denied: '/zope/prd/zeo/log/zeo.log'

[Andreas Jung (ajung)]

Changes: submitter email, importance (medium => low), new comment

There is usually no need to install Zope/ZEO as root.
It is "best practice" to install Zope/ZEO as unprivileged user.

[Darryl Dixon (esrever-otua)]

With all due respect, that is totally beside the point.
1) There is a 'user zope' directive in the configuration file that the zeo server actually honours
2) The zeo server fails to correctly manage the permissions on the files it creates correctly, thus breaking itself when it starts its children up as the 'zope' user.

The whole point of an 'effective user' directive is that a main server process, that never actually receives any user data at all, can be started, and will then fork and manage children with lower privileges to actually do the messy business of interacting with the rest of the world. The point is that this standard Unix feature is broken for ZEO, even though it says it supports it.

I would suggest that there are two possibilities for a 'good fix' here:
1) either a trivial fix to make the logfile get set with the correct permissions of the child process, or
2) remove all the code that knows how to 'drop privileges' and get rid of the option for it in the config file.

Cheers,
D

[Colin Watson (cjwatson)]

The zope.mkzeoinstance project on Launchpad has been archived at the request of the Zope developers (see https://answers.launchpad.net/launchpad/+question/683589 and https://answers.launchpad.net/launchpad/+question/685285). If this bug is still relevant, please refile it at https://github.com/zopefoundation/zope.mkzeoinstance.