Jira (PUP-3777) Readonly mountpoint mounted after read-write mountpoint causes unexpected altering of permissions

[William Hopper (JIRA)]

Title: Message Title

William Hopper updated an issue   Puppet / PUP-3777 Readonly mountpoint mounted after read-write mountpoint causes unexpected altering of permissions Change By: William Hopper In a manifest that specifies two mount resources from the same NFS server, where one is defined as read-only and the other read-write, if the read-only mountpoint is mounted *after* the read-write mountpoint, then the read-write mountpoint is unexpectedly forced to become read-only. This is due to a combination of how Puppet deals with refreshing mountpoints and an apparently expected behavior of NFSv4, due to the behavior of the {{remount}} option. When Puppet first mounts an NFS filesystem, it will immediately run the command {{mount -o remount <mountpoint } >}}. Since our Puppet manifest is specifying two mountpoints, it will do this twice. On the second time, it will be remounting the read-only mountpoint, which will strangely cause the read-write mountpoint to become read-only. This is due to the fact that the second mount uses the first mount's superblock, and NFS treats the two mounts are mounting the same export. See https://bugzilla.redhat.com/show_bug.cgi?id=1158046 for more information. Also see https://projects.puppetlabs.com/issues/113 for the addition of the self refresh option and https://projects.puppetlabs.com/issues/6027 for more context. One potential solution is to use the {{nosharecache}} option to prevent the remounts from affecting the wrong mountpoint. Example problem manifest: {noformat} node 'master' {     package {'nfs-utils':         ensure => installed,         allow_virtual => false,     }     service {['nfs','rpcbind']:         ensure => running,         require => Package['nfs-utils'],     }     exec {'/usr/sbin/exportfs -ra':         refreshonly => true     }     file {'/var/share':         ensure => directory,     }     file {'/var/readonly':         ensure => directory,     }     file_line {'export share':         path => '/etc/exports',         line => '/var/share -rw,sync,no_root_squash 10.0.0.0/8',         match => '^/var/share',         require => Service['nfs','rpcbind'],         notify => Exec['/usr/sbin/exportfs -ra'],     }     file_line {'export readonly':         path => '/etc/exports',         line => '/var/readonly -ro,sync,no_root_squash 10.0.0.0/8',         match => '^/var/readonly',         require => Service['nfs','rpcbind'],         notify => Exec['/usr/sbin/exportfs -ra'],     } } # Agent node 'agent' {         package {'nfs-utils':             ensure => installed,         }         file { ['/nfs','/nfs/share','/nfs/readonly']:             ensure => directory,         }         mount { '/nfs/share':             ensure => mounted,             atboot => true,             device => "10.32.115.67:/var/share",             fstype => 'nfs',             options => 'rw',             require => [File['/nfs/share']]         }         mount { '/nfs/readonly':             ensure => mounted,             atboot => true,             device => "10.32.115.67:/var/readonly",             fstype => 'nfs',             options => 'ro',             require => [File['/nfs/readonly'],Mount['/nfs/share']]     } } {noformat} Add Comment   This message was sent by Atlassian JIRA (v6.3.7#6337-sha1:2ed701e) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.