OVN startup scripts recursively chown the log directory, overriding ownership managed by distributions.
Add an opt-in mode that skips recursive log-directory chown and installs a directory-only tmpfiles rule with mode 2750. Leave existing log files and their modes unchanged. Setgid provides initial group inheritance for newly created logs. When --ovn-user is specified, OVS subsequently changes the active log's owner and group to the runtime identity. Administrators must provision directories consistently with that identity and any overridden log paths. Control sysusers installation independently. Debian uses root:adm and disables sysusers; Fedora uses the account supplied by Open vSwitch and disables sysusers by default. Avoid assigning primary group root to generated non-root accounts. Keep legacy ownership handling as the default for source builds. Add regression tests for ownership gating and generated configurations, plus an enabled-mode CI job. Reported-at: https://github.com/ovn-org/ovn/issues/310 Signed-off-by: Zhang Hua <[email protected]> --- Submitted-at: https://github.com/ovn-org/ovn/pull/311 v2: - Added the trailing dot required by checkpatch to the subject. v3: - Added sysusers.d support alongside tmpfiles.d. - Added --with-sysusersdir configure option. - Generate sysusers.d entries from the configured log user/group. - Install the generated sysusers.d file in Debian packaging. - Do not package the generated sysusers.d file for Fedora/RHEL because the openvswitch user is managed by the Open vSwitch package there. v4: - Make tmpfiles-based log ownership opt-in with the new --enable-tmpfiles-log-ownership configure option. - Keep the option disabled by default so deployments without systemd-tmpfiles retain ovn-ctl and ovn-lib's existing recursive log-directory ownership handling. - Install the tmpfiles.d and sysusers.d helpers only when the option is enabled. - Explicitly enable tmpfiles log ownership in Debian and Fedora packaging. - Configure Debian log ownership as root:adm. - Configure Fedora log ownership as openvswitch:openvswitch and apply the tmpfiles configuration in the RPM %post script. - Do not package OVN's generated sysusers.d file on Fedora/RHEL, where the openvswitch user is managed by the Open vSwitch package. v5: - Use a consistent author and Signed-off-by identity. v6: - Create only the log directory in tmpfiles; do not enumerate individual log files. - Set the directory mode to 2750 so dynamically created log files inherit the configured log group. - Decouple sysusers installation from tmpfiles installation with --enable-sysusers-log-ownership. - Disable OVN sysusers in Debian, where root:adm already exists, and install it conditionally only when staged by the build. - Add an optional ovn_sysusers RPM build condition that consistently controls configure, package contents, and %sysusers_create. - Do not add per-subpackage RPM %post tmpfiles handling; the base %post creates the shared log directory only. - Add trailing newlines to the tmpfiles and sysusers templates. v7: - Added the trailing dot required by checkpatch to the subject. v8: - Add a runtime tmpfiles dependency to Debian ovn-common package. - Avoid assigning primary group root to generated sysusers user entries when a non-root log user is configured with log group root. - Clarify documentation regarding log directory provisioning when running daemons with --ovn-user in tmpfiles mode. - Add regression tests for ovn-ctl log directory ownership handling and configuration template generation. - Add a CI job exercising the tmpfiles and sysusers configure options. v9: - Replace tab indentation with spaces in tests/ovn-ctl.at to satisfy the check-tabs build rule. Testing: - Ran utilities/checkpatch.py -1. - Ran make check TESTSUITEFLAGS="-j$(nproc)". - Built, installed, and validated both default and sysusers-enabled Debian packages in Ubuntu 24.04 (verified log directory mode 2750 root:adm, daemon startup, service restarts, and logrotate/reopen). - Built, installed, and validated Fedora RPM packages both with and without --with ovn_sysusers (verified 2750 openvswitch:openvswitch directory and daemon logs, scriptlet execution order, and log rotation). - Verified standalone source installations for both enabled (tmpfiles/sysusers) and disabled (legacy recursive chown preserving daemon:daemon) modes. .ci/ci.sh | 4 +- .github/workflows/test.yml | 6 ++ Documentation/intro/install/general.rst | 27 ++++++++ Makefile.am | 9 +++ configure.ac | 5 ++ debian/control | 3 +- debian/ovn-common.install | 1 + debian/rules | 2 +- m4/ovn.m4 | 84 +++++++++++++++++++++++++ rhel/ovn-fedora.spec.in | 21 +++++++ tests/atlocal.in | 7 +++ tests/automake.mk | 6 +- tests/ovn-ctl.at | 81 ++++++++++++++++++++++++ tests/testsuite.at | 1 + utilities/automake.mk | 12 ++++ utilities/ovn-ctl | 9 +-- utilities/ovn-lib.in | 5 +- utilities/ovn-sysusers.conf.in | 2 + utilities/ovn-tmpfiles.conf.in | 2 + 19 files changed, 276 insertions(+), 11 deletions(-) create mode 100644 tests/ovn-ctl.at create mode 100644 utilities/ovn-sysusers.conf.in create mode 100644 utilities/ovn-tmpfiles.conf.in diff --git a/.ci/ci.sh b/.ci/ci.sh index 19749a039..cf3cc3fb3 100755 --- a/.ci/ci.sh +++ b/.ci/ci.sh @@ -94,8 +94,8 @@ function run_tests() { container_exec " cd $CONTAINER_WORKDIR \ && \ - ARCH=$ARCH CC=$CC LIBS=$LIBS OPTS=$OPTS TESTSUITE=$TESTSUITE \ - TEST_RANGE=$TEST_RANGE SANITIZERS=$SANITIZERS DPDK=$DPDK \ + ARCH=$ARCH CC=$CC LIBS=$LIBS OPTS=\"$OPTS\" TESTSUITE=$TESTSUITE \ + TEST_RANGE=\"$TEST_RANGE\" SANITIZERS=$SANITIZERS DPDK=$DPDK \ RECHECK=$RECHECK UNSTABLE=$UNSTABLE TIMEOUT=$TIMEOUT \ BASE_VERSION=$BASE_VERSION JOBS=$JOBS ./.ci/linux-build.sh " diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7f987355d..432bbadcf 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -113,6 +113,12 @@ jobs: cfg: - { compiler: gcc, opts: --disable-ssl } - { compiler: clang, opts: --disable-ssl } + - compiler: gcc + opts: >- + --enable-tmpfiles-log-ownership --enable-sysusers-log-ownership + --with-log-user=openvswitch --with-log-group=openvswitch + testsuite: test + test_range: "-k ovn-ctl" - { compiler: gcc, testsuite: dist-test } - { compiler: gcc, testsuite: test, test_range: "-300" } - { compiler: gcc, testsuite: test, test_range: "301-600" } diff --git a/Documentation/intro/install/general.rst b/Documentation/intro/install/general.rst index 83d29af4b..eb50e8a59 100644 --- a/Documentation/intro/install/general.rst +++ b/Documentation/intro/install/general.rst @@ -339,6 +339,33 @@ Building $ sudo make install +Log Directory Ownership +----------------------- + +Source builds retain the startup scripts' recursive log-directory ownership +handling by default. Configure with ``--enable-tmpfiles-log-ownership +--with-log-user=USER --with-log-group=GROUP`` to manage the directory with +systemd-tmpfiles instead. The directory-only rule uses mode 2750 so new files +inherit its group; it does not migrate existing log files or their modes. + +Account creation defaults to following the tmpfiles option and can be +controlled separately with ``--enable-sysusers-log-ownership`` or +``--disable-sysusers-log-ownership``. Disable it if another package provides +the accounts. For source installations, apply the installed rules before +starting OVN (adjust paths for a different prefix):: + + $ sudo systemd-sysusers /usr/local/lib/sysusers.d/ovn-sysusers.conf + $ sudo systemd-tmpfiles --create \ + /usr/local/lib/tmpfiles.d/ovn-tmpfiles.conf + +Skip sysusers if disabled; ``make install`` alone does not apply these rules. + +Provision directories to match the runtime identity and any overridden log +paths: startup scripts no longer reconcile log ownership in tmpfiles mode. +With ``--ovn-user``, OVS changes the active log's owner and group before +dropping privileges; setgid alone cannot preserve a different reader group. +Default root execution without ``--ovn-user`` supports ``root:adm``. + .. _general-starting: Starting diff --git a/Makefile.am b/Makefile.am index 8a9bf1e91..e01bd2765 100644 --- a/Makefile.am +++ b/Makefile.am @@ -129,6 +129,8 @@ noinst_PROGRAMS = noinst_SCRIPTS = OVSIDL_BUILT = pkgdata_DATA = +tmpfiles_DATA = +sysusers_DATA = sbin_SCRIPTS = scripts_SCRIPTS = completion_SCRIPTS = @@ -146,6 +148,8 @@ endif scriptsdir = $(pkgdatadir)/scripts completiondir = $(sysconfdir)/bash_completion.d pkgconfigdir = $(libdir)/pkgconfig +tmpfilesdir = @TMPFILESDIR@ +sysusersdir = @SYSUSERSDIR@ # This ensures that files added to EXTRA_DIST are always distributed, # even if they are inside an Automake if...endif conditional block that is @@ -164,6 +168,11 @@ SUFFIXES += .in sed \ -e 's,[@]PKIDIR[@],$(PKIDIR),g' \ -e 's,[@]LOGDIR[@],$(LOGDIR),g' \ + -e 's,[@]LOGUSER[@],$(LOGUSER),g' \ + -e 's,[@]LOGGROUP[@],$(LOGGROUP),g' \ + -e 's,[@]OVN_CHOWN_LOGDIR[@],$(OVN_CHOWN_LOGDIR),g' \ + -e 's,[@]SYSUSERS_GROUP_LINE[@],$(SYSUSERS_GROUP_LINE),g' \ + -e 's,[@]SYSUSERS_USER_LINE[@],$(SYSUSERS_USER_LINE),g' \ -e 's,[@]DBDIR[@],$(DBDIR),g' \ -e 's,[@]PYTHON3[@],$(PYTHON3),g' \ -e 's,[@]OVN_RUNDIR[@],$(OVN_RUNDIR),g' \ diff --git a/configure.ac b/configure.ac index 06c3cf5d4..fecb9da8d 100644 --- a/configure.ac +++ b/configure.ac @@ -88,6 +88,11 @@ OVS_CHECK_NETLINK OVS_CHECK_LINUX_NETLINK OVS_CHECK_OPENSSL OVN_CHECK_LOGDIR +OVN_CHECK_LOGUSER +OVN_CHECK_LOGGROUP +OVN_CHECK_TMPFILES_LOG_OWNERSHIP +OVN_CHECK_TMPFILESDIR +OVN_CHECK_SYSUSERSDIR OVN_CHECK_PYTHON3 OVN_CHECK_FLAKE8 OVN_CHECK_SPHINX diff --git a/debian/control b/debian/control index d99b483ac..bcd459dc2 100644 --- a/debian/control +++ b/debian/control @@ -25,7 +25,8 @@ Homepage: http://www.ovn.org/ Package: ovn-common Architecture: linux-any -Depends: ${misc:Depends}, +Depends: systemd | systemd-tmpfiles, + ${misc:Depends}, ${shlibs:Depends} Description: OVN common components OVN, the Open Virtual Network, is a system to support virtual network diff --git a/debian/ovn-common.install b/debian/ovn-common.install index 6e51dffb8..a804f7c5b 100644 --- a/debian/ovn-common.install +++ b/debian/ovn-common.install @@ -9,4 +9,5 @@ usr/bin/ovn-debug usr/share/ovn/scripts/ovn-ctl usr/share/ovn/scripts/ovndb-servers.ocf usr/share/ovn/scripts/ovn-lib +usr/lib/tmpfiles.d/ovn-tmpfiles.conf usr/lib/*/libovn*.so.* diff --git a/debian/rules b/debian/rules index b25a0b48e..6f4180b4d 100755 --- a/debian/rules +++ b/debian/rules @@ -30,7 +30,7 @@ override_dh_autoreconf: dh_autoreconf $(DH_AS_NEEDED) override_dh_auto_configure: - dh_auto_configure -- --enable-ssl --enable-shared --with-ovs-source=${OVSDIR} $(EXTRA_CONFIGURE_OPTS) + dh_auto_configure -- --enable-ssl --enable-shared --enable-tmpfiles-log-ownership --disable-sysusers-log-ownership --with-ovs-source=${OVSDIR} --with-log-user=root --with-log-group=adm $(EXTRA_CONFIGURE_OPTS) override_dh_auto_test: ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS))) diff --git a/m4/ovn.m4 b/m4/ovn.m4 index 6be2bba09..518b45efd 100644 --- a/m4/ovn.m4 +++ b/m4/ovn.m4 @@ -127,6 +127,90 @@ AC_DEFUN([OVN_CHECK_LOGDIR], [LOGDIR='${localstatedir}/log/${PACKAGE}']) AC_SUBST([LOGDIR])]) +dnl Checks for the user that should own log files. +AC_DEFUN([OVN_CHECK_LOGUSER], + [AC_ARG_WITH( + [log-user], + AS_HELP_STRING([--with-log-user=USER], + [user used for log files [[root]]]), + [LOGUSER=$withval], + [LOGUSER=root]) + AC_SUBST([LOGUSER])]) + +dnl Checks for the group that should own log files. +AC_DEFUN([OVN_CHECK_LOGGROUP], + [AC_ARG_WITH( + [log-group], + AS_HELP_STRING([--with-log-group=GROUP], + [group used for log files [[root]]]), + [LOGGROUP=$withval], + [LOGGROUP=root]) + AC_SUBST([LOGGROUP])]) + +dnl Checks whether tmpfiles.d manages log ownership. +AC_DEFUN([OVN_CHECK_TMPFILES_LOG_OWNERSHIP], + [AC_ARG_ENABLE( + [tmpfiles-log-ownership], + [AS_HELP_STRING([--enable-tmpfiles-log-ownership], + [manage log ownership with tmpfiles.d])], + [case "${enableval}" in + (yes) tmpfiles_log_ownership=true ;; + (no) tmpfiles_log_ownership=false ;; + (*) AC_MSG_ERROR([bad value ${enableval} for --enable-tmpfiles-log-ownership]) ;; + esac], + [tmpfiles_log_ownership=false]) + AM_CONDITIONAL([TMPFILES_LOG_OWNERSHIP], + [test x$tmpfiles_log_ownership = xtrue]) + AS_IF([test x$tmpfiles_log_ownership = xtrue], + [OVN_CHOWN_LOGDIR=no], + [OVN_CHOWN_LOGDIR=yes]) + AC_SUBST([OVN_CHOWN_LOGDIR])]) + +dnl Checks for the directory in which to install tmpfiles.d configuration. +AC_DEFUN([OVN_CHECK_TMPFILESDIR], + [AC_ARG_WITH( + [tmpfilesdir], + AS_HELP_STRING([--with-tmpfilesdir=DIR], + [directory used for tmpfiles.d configuration + [[PREFIX/lib/tmpfiles.d]]]), + [TMPFILESDIR=$withval], + [TMPFILESDIR='${prefix}/lib/tmpfiles.d']) + AC_SUBST([TMPFILESDIR])]) + +dnl Checks for the directory in which to install sysusers.d configuration. +AC_DEFUN([OVN_CHECK_SYSUSERSDIR], + [AC_ARG_WITH( + [sysusersdir], + AS_HELP_STRING([--with-sysusersdir=DIR], + [directory used for sysusers.d configuration + [[PREFIX/lib/sysusers.d]]]), + [SYSUSERSDIR=$withval], + [SYSUSERSDIR='${prefix}/lib/sysusers.d']) + AC_ARG_ENABLE( + [sysusers-log-ownership], + [AS_HELP_STRING([--enable-sysusers-log-ownership], + [create log user and group with sysusers.d])], + [case "${enableval}" in + (yes) sysusers_log_ownership=true ;; + (no) sysusers_log_ownership=false ;; + (*) AC_MSG_ERROR([bad value ${enableval} for --enable-sysusers-log-ownership]) ;; + esac], + [sysusers_log_ownership=$tmpfiles_log_ownership]) + AM_CONDITIONAL([SYSUSERS_LOG_OWNERSHIP], + [test x$sysusers_log_ownership = xtrue && + { test x$LOGUSER != xroot || test x$LOGGROUP != xroot; }]) + AS_IF([test "x$LOGGROUP" = xroot], + [SYSUSERS_GROUP_LINE=], + [SYSUSERS_GROUP_LINE="g $LOGGROUP -"]) + AS_IF([test "x$LOGUSER" = xroot], + [SYSUSERS_USER_LINE=], + [AS_IF([test "x$LOGGROUP" = xroot], + [SYSUSERS_USER_LINE="u $LOGUSER - \"OVN log user\" -"], + [SYSUSERS_USER_LINE="u $LOGUSER -:$LOGGROUP \"OVN log user\" -"])]) + AC_SUBST([SYSUSERSDIR]) + AC_SUBST([SYSUSERS_GROUP_LINE]) + AC_SUBST([SYSUSERS_USER_LINE])]) + dnl Checks for the directory in which to store the OVN database. AC_DEFUN([OVN_CHECK_DBDIR], [AC_ARG_WITH( diff --git a/rhel/ovn-fedora.spec.in b/rhel/ovn-fedora.spec.in index 8c8b96050..f259a6e3b 100644 --- a/rhel/ovn-fedora.spec.in +++ b/rhel/ovn-fedora.spec.in @@ -40,6 +40,11 @@ Provides: openvswitch-ovn-common = %{?epoch:%{epoch}:}%{version}-%{release} # to skip running checks, pass --without check %bcond_without check +# The Open vSwitch package normally provisions the openvswitch account. +# Pass --with ovn_sysusers only for a package that provisions a distinct OVN +# log user or group. +%bcond_with ovn_sysusers + # Nearly all of openvswitch is ASL 2.0. The lib/sflow*.[ch] files are SISSL License: ASL 2.0 and SISSL Release: 1%{?dist} @@ -152,6 +157,14 @@ cd - --disable-libcapng \ %endif --enable-ssl \ + --enable-tmpfiles-log-ownership \ + %if %{with ovn_sysusers} + --enable-sysusers-log-ownership \ + %else + --disable-sysusers-log-ownership \ + %endif + --with-log-user=openvswitch \ + --with-log-group=openvswitch \ --with-pkidir=%{_sharedstatedir}/openvswitch/pki \ --with-version-suffix=-%{release} \ PYTHON3=%{__python3} @@ -331,6 +344,10 @@ fi %post ln -sf ovn_detrace.py %{_bindir}/ovn-detrace +%if %{with ovn_sysusers} +%sysusers_create ovn-sysusers.conf +%endif +%tmpfiles_create ovn-tmpfiles.conf %if %{with libcapng} if [ $1 -eq 1 ]; then @@ -516,6 +533,10 @@ fi %{_mandir}/man8/ovn-debug.8* %{_prefix}/lib/ocf/resource.d/ovn/ovndb-servers %config(noreplace) %{_sysconfdir}/logrotate.d/ovn +%{_tmpfilesdir}/ovn-tmpfiles.conf +%if %{with ovn_sysusers} +%{_sysusersdir}/ovn-sysusers.conf +%endif %{_unitdir}/[email protected] %files central diff --git a/tests/atlocal.in b/tests/atlocal.in index bde146cfd..f25d32758 100644 --- a/tests/atlocal.in +++ b/tests/atlocal.in @@ -2,6 +2,13 @@ HAVE_OPENSSL='@HAVE_OPENSSL@' HAVE_UNBOUND='@HAVE_UNBOUND@' EGREP='@EGREP@' +OVN_TEST_CHOWN_LOGDIR='@OVN_CHOWN_LOGDIR@' +OVN_TEST_TMPFILES_DISABLED='@TMPFILES_LOG_OWNERSHIP_TRUE@' +OVN_TEST_LOGUSER='@LOGUSER@' +OVN_TEST_LOGGROUP='@LOGGROUP@' +OVN_TEST_PREFIX='@prefix@' +OVN_TEST_LOCALSTATEDIR='@localstatedir@' +OVN_TEST_LOGDIR='@LOGDIR@' if test x"$PYTHON3" = x; then PYTHON3='@PYTHON3@' diff --git a/tests/automake.mk b/tests/automake.mk index 8f7a8c4fa..570d04bf9 100644 --- a/tests/automake.mk +++ b/tests/automake.mk @@ -47,7 +47,8 @@ TESTSUITE_AT = \ tests/ovn-vif-plug.at \ tests/ovn-util.at \ tests/ovn-br-controller.at \ - tests/ovn-inc-proc-graph-dump.at + tests/ovn-inc-proc-graph-dump.at \ + tests/ovn-ctl.at SYSTEM_DPDK_TESTSUITE_AT = \ tests/system-dpdk-testsuite.at \ @@ -97,7 +98,8 @@ AUTOTEST_PATH = $(ovs_builddir)/utilities:$(ovs_builddir)/vswitchd:$(ovs_builddi export ovs_srcdir export ovs_builddir -check-local: +check-local: $(TESTSUITE) utilities/ovn-lib utilities/ovn-tmpfiles.conf \ + utilities/ovn-sysusers.conf set $(SHELL) '$(TESTSUITE)' -C tests AUTOTEST_PATH=$(AUTOTEST_PATH); \ "$$@" $(TESTSUITEFLAGS) || \ (test -z "$$(find $(TESTSUITE_DIR) -name 'sanitizers.*')" && \ diff --git a/tests/ovn-ctl.at b/tests/ovn-ctl.at new file mode 100644 index 000000000..b592ed017 --- /dev/null +++ b/tests/ovn-ctl.at @@ -0,0 +1,81 @@ +AT_BANNER([ovn-ctl]) + +dnl The log-ownership reconciliation in start_ovn_daemon is gated on +dnl @OVN_CHOWN_LOGDIR@, substituted from the --enable-tmpfiles-log-ownership +dnl configure option. Exercise both branches with a chown stub so that a +dnl dropped substitution or an inverted test is caught in CI. +AT_SETUP([ovn-ctl - log directory ownership reconciliation]) +AT_CHECK([test -f "$abs_top_builddir/utilities/ovn-lib"]) + +dnl Record chown invocations instead of touching the system. +mkdir stub +cat > stub/chown <<'EOF' +#!/bin/sh +echo "chown $*" >> "$OVN_CHOWN_LOG" +EOF +chmod +x stub/chown +PATH=$PWD/stub:$PATH +OVN_CHOWN_LOG=$PWD/chown.log +export OVN_CHOWN_LOG + +. "$abs_top_builddir/utilities/ovn-lib" + +dnl The build must substitute @OVN_CHOWN_LOGDIR@ to a concrete value. +AT_CHECK([case $ovn_chown_logdir in yes|no) ;; *) exit 1 ;; esac]) + +dnl Neutralize the side effects unrelated to ownership. +ovn_logdir=$PWD/log +ovn_rundir=$PWD/run +ovn_install_dir () { INSTALL_USER=$(id -un); INSTALL_GROUP=$(id -gn); } +start_wrapped_daemon () { :; } +cd () { :; } + +dnl Default build: both the log and run directories are reconciled. +: > "$OVN_CHOWN_LOG" +ovn_chown_logdir=yes +start_ovn_daemon "" "" ovn-northd +AT_CHECK([grep -q " $ovn_logdir\$" "$OVN_CHOWN_LOG"], [0]) +AT_CHECK([grep -q " $ovn_rundir\$" "$OVN_CHOWN_LOG"], [0]) + +dnl tmpfiles build: the log directory is left to tmpfiles, the run +dnl directory is still reconciled. +: > "$OVN_CHOWN_LOG" +ovn_chown_logdir=no +start_ovn_daemon "" "" ovn-northd +AT_CHECK([grep -q " $ovn_logdir\$" "$OVN_CHOWN_LOG"], [1]) +AT_CHECK([grep -q " $ovn_rundir\$" "$OVN_CHOWN_LOG"], [0]) + +AT_CLEANUP + +AT_SETUP([ovn-ctl - configured ownership templates]) +AT_KEYWORDS([ovn-ctl]) +AT_CHECK([test -f "$abs_top_builddir/utilities/ovn-lib"]) +AT_CHECK([. "$abs_top_builddir/utilities/ovn-lib" +test "$ovn_chown_logdir" = "$OVN_TEST_CHOWN_LOGDIR" +case "$OVN_TEST_TMPFILES_DISABLED" in + '') test "$ovn_chown_logdir" = no ;; + '#') test "$ovn_chown_logdir" = yes ;; + *) exit 1 ;; +esac]) +AT_CHECK([prefix=$OVN_TEST_PREFIX +eval localstatedir=\"$OVN_TEST_LOCALSTATEDIR\" +PACKAGE=ovn +eval logdir=\"$OVN_TEST_LOGDIR\" +printf 'd %s 2750 %s %s -\n' "$logdir" "$OVN_TEST_LOGUSER" \ + "$OVN_TEST_LOGGROUP" > expected-tmpfiles +sed '/^#/d' "$abs_top_builddir/utilities/ovn-tmpfiles.conf" > actual-tmpfiles +diff -u expected-tmpfiles actual-tmpfiles]) +AT_CHECK([group_line= user_line= +if test "$OVN_TEST_LOGGROUP" != root; then + group_line="g $OVN_TEST_LOGGROUP -" +fi +if test "$OVN_TEST_LOGUSER" != root; then + user_id=- + if test "$OVN_TEST_LOGGROUP" != root; then + user_id="-:$OVN_TEST_LOGGROUP" + fi + user_line="u $OVN_TEST_LOGUSER $user_id \"OVN log user\" -" +fi +printf '%s\n%s\n' "$group_line" "$user_line" > expected-sysusers +diff -u expected-sysusers "$abs_top_builddir/utilities/ovn-sysusers.conf"]) +AT_CLEANUP diff --git a/tests/testsuite.at b/tests/testsuite.at index 6216ac761..8ec5e239c 100644 --- a/tests/testsuite.at +++ b/tests/testsuite.at @@ -43,3 +43,4 @@ m4_include([tests/ovn-vif-plug.at]) m4_include([tests/ovn-util.at]) m4_include([tests/ovn-br-controller.at]) m4_include([tests/ovn-inc-proc-graph-dump.at]) +m4_include([tests/ovn-ctl.at]) diff --git a/utilities/automake.mk b/utilities/automake.mk index edf3fe9cd..210412ac7 100644 --- a/utilities/automake.mk +++ b/utilities/automake.mk @@ -24,6 +24,8 @@ EXTRA_DIST += \ utilities/ovn-ctl \ utilities/ovn-lib.in \ utilities/ovn-ctl.8.xml \ + utilities/ovn-tmpfiles.conf.in \ + utilities/ovn-sysusers.conf.in \ utilities/ovn-nbctl.8.xml \ utilities/ovn-sbctl.8.xml \ utilities/ovn-ic-nbctl.8.xml \ @@ -44,6 +46,8 @@ EXTRA_DIST += \ CLEANFILES += \ utilities/ovn-ctl.8 \ utilities/ovn-lib \ + utilities/ovn-tmpfiles.conf \ + utilities/ovn-sysusers.conf \ utilities/ovn-nbctl.8 \ utilities/ovn-sbctl.8 \ utilities/ovn-ic-nbctl.8 \ @@ -56,7 +60,15 @@ CLEANFILES += \ utilities/ovn-appctl.8 \ utilities/ovn-appctl +if TMPFILES_LOG_OWNERSHIP +tmpfiles_DATA += utilities/ovn-tmpfiles.conf +endif +if SYSUSERS_LOG_OWNERSHIP +sysusers_DATA += utilities/ovn-sysusers.conf +endif utilities/ovn-lib: $(top_builddir)/config.status +utilities/ovn-tmpfiles.conf: $(top_builddir)/config.status +utilities/ovn-sysusers.conf: $(top_builddir)/config.status # ovn-nbctl bin_PROGRAMS += utilities/ovn-nbctl diff --git a/utilities/ovn-ctl b/utilities/ovn-ctl index 559fffddb..c03fcbd68 100755 --- a/utilities/ovn-ctl +++ b/utilities/ovn-ctl @@ -281,9 +281,8 @@ $cluster_remote_port upgrade_db "$file" "$schema" fi - # Set the owner of the ovn_dbdir (with -R option) to OVN_USER if set. - # This is required because the ovndbs are created with root permission - # if not present when create_cluster/upgrade_db is called. + # Database files may be created as root before ovsdb-server drops + # privileges, so keep ownership aligned with OVN_USER when configured. INSTALL_USER="$(id -un)" INSTALL_GROUP="$(id -gn)" [ "$OVN_USER" != "" ] && INSTALL_USER="${OVN_USER%:*}" @@ -291,7 +290,9 @@ $cluster_remote_port chown -R $INSTALL_USER:$INSTALL_GROUP $ovn_dbdir chown -R $INSTALL_USER:$INSTALL_GROUP $OVN_RUNDIR - chown -R $INSTALL_USER:$INSTALL_GROUP $ovn_logdir + if test "$ovn_chown_logdir" = yes; then + chown -R $INSTALL_USER:$INSTALL_GROUP $ovn_logdir + fi chown -R $INSTALL_USER:$INSTALL_GROUP $ovn_etcdir set ovsdb-server diff --git a/utilities/ovn-lib.in b/utilities/ovn-lib.in index 8e8eedeab..cd6556cbf 100644 --- a/utilities/ovn-lib.in +++ b/utilities/ovn-lib.in @@ -29,6 +29,7 @@ ovn_etcdir=$ovn_sysconfdir/ovn # /etc/ovn ovn_datadir=${OVN_PKGDATADIR-'@pkgdatadir@'} # /usr/share/ovn ovn_bindir=${OVN_BINDIR-'@bindir@'} # /usr/bin ovn_sbindir=${OVN_SBINDIR-'@sbindir@'} # /usr/sbin +ovn_chown_logdir='@OVN_CHOWN_LOGDIR@' # /etc/ovn or /var/lib/ovn if test X"$OVN_DBDIR" != X; then @@ -133,7 +134,9 @@ start_ovn_daemon () { set "$@" --detach test X"$MONITOR" = Xno || set "$@" --monitor - chown -R $INSTALL_USER:$INSTALL_GROUP $ovn_logdir + if test "$ovn_chown_logdir" = yes; then + chown -R $INSTALL_USER:$INSTALL_GROUP $ovn_logdir + fi chown -R $INSTALL_USER:$INSTALL_GROUP $ovn_rundir start_wrapped_daemon "$wrapper" $daemon "$priority" "$@" diff --git a/utilities/ovn-sysusers.conf.in b/utilities/ovn-sysusers.conf.in new file mode 100644 index 000000000..e067cadbc --- /dev/null +++ b/utilities/ovn-sysusers.conf.in @@ -0,0 +1,2 @@ +@SYSUSERS_GROUP_LINE@ +@SYSUSERS_USER_LINE@ diff --git a/utilities/ovn-tmpfiles.conf.in b/utilities/ovn-tmpfiles.conf.in new file mode 100644 index 000000000..c4d0321ce --- /dev/null +++ b/utilities/ovn-tmpfiles.conf.in @@ -0,0 +1,2 @@ +# The setgid bit makes log files created in this directory inherit @LOGGROUP@. +d @LOGDIR@ 2750 @LOGUSER@ @LOGGROUP@ - -- 2.43.0 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
