Bug#760945: postinst overwrites permissions set by admin, destroys configuration for slaves
On 28.11.2017 21:43, Sven Hartge wrote: > This should fix this bug. Sorry, this fixes the second part of the bug. The permission problem with /etc/smokeping/smokeping_secrets still persists. This file should not be 640 and smokeping:smokeping but instead 640 and smokeping:www-data. Grüße, Sven. signature.asc Description: OpenPGP digital signature
Bug#760945: postinst overwrites permissions set by admin, destroys configuration for slaves
Um 10:43 Uhr am 28.11.17 schrieb Antoine Beaupre:
> On Wed, Oct 21, 2015 at 08:33:39PM +0200, Christoph Berg wrote:
>> Re: Sven Hartge 2014-09-09 <540f1207.7000...@svenhartge.de>
Also the directory /var/lib/smokeping needs to be writable by www-data
to allow the data submitted by the slaves to be written to the RRD
files or you will get errors like this in the Apache error log:
smokeping.cgi [client 10.1.1.32]: Could not update
/var/lib/smokeping//Remote/Campus_Remote/swXXX-remote-v1.smoke-slave.slave_cache,
giving up for now. at /usr/share/perl5/Smokeping/Master.pm line 156.
>>>
>>> Correction: The permissions for /var/lib/smokeping are fine, but the
>>> default configuration is missing the "dyndir" directive causing the CGI
>>> trying to write into the datadir instead of the correct directory
>>> /var/lib/smokeping/__cgi.
>> I ran into this as well, it would be nice if the package got fixed.
>> The default /var/lib/smokeping/__cgi permissions need to be adjusted
>> as well:
>> drwxrwsr-x 4 smokeping www-data 4096 Okt 21 20:24 /var/lib/smokeping/__cgi
>
> So I'm not sure I follow all the proposed changes here.
I checked on a fresh installation and the permissions of
/var/lib/smokeping/__cgi are fine, they should be 2775 and
smokeping:www-data.
The main problem is the missing "dyndir" value from
/etc/smokeping/config.d/pathnames, which needs to be set to
"/var/lib/smokeping/__cgi".
Unfortunately just adding it to debian/split_config like so ...
@@ -14,8 +14,8 @@ do
fi
done
-egrep 'sendmail|imgcache|imgurl|datadir|piddir|smokemail|tmail'
${DESTDIR}/etc/smokeping/config.d/General >
${DESTDIR}/etc/smokeping/config.d/pathnames
+egrep 'sendmail|imgcache|imgurl|datadir|dyndir|piddir|smokemail|tmail'
${DESTDIR}/etc/smokeping/config.d/General >
${DESTDIR}/etc/smokeping/config.d/pathnames
-sed -i '/sendmail\|imgcache\|imgurl\|datadir\|piddir\|smokemail\|tmail/d'
${DESTDIR}/etc/smokeping/config.d/General
+sed -i
'/sendmail\|imgcache\|imgurl\|datadir\|dyndir\|piddir\|smokemail\|tmail/d'
${DESTDIR}/etc/smokeping/config.d/General
echo '@include /etc/smokeping/config.d/pathnames' >>
${DESTDIR}/etc/smokeping/config.d/General
... is not enough, as the configure script never adds it to
config.d/General to begin with. (Might be worth reporting to upstream.)
As a workaround I propose to manually add the hardcoded value for the time
being:
@@ -15,6 +15,7 @@ do
done
egrep 'sendmail|imgcache|imgurl|datadir|dyndir|piddir|smokemail|tmail'
${DESTDIR}/etc/smokeping/config.d/General >
${DESTDIR}/etc/smokeping/config.d/pathnames
+echo 'dyndir = /var/lib/smokeping/__cgi' >>
${DESTDIR}/etc/smokeping/config.d/pathnames
sed -i
'/sendmail\|imgcache\|imgurl\|datadir\|dyndir\|piddir\|smokemail\|tmail/d'
${DESTDIR}/etc/smokeping/config.d/General
This should fix this bug. I am attaching patches based on current git HEAD
18e0f0a72a63d2ab3034dbb648c717aa74c27012 to fix this and Bug#826056,
currently causing a FTBFS bug.
Grüße,
SvenFrom 3bfbe49618ab62fc7a68d214ddc1de211ae111b7 Mon Sep 17 00:00:00 2001
From: Sven Hartge
Date: Tue, 28 Nov 2017 21:12:11 +0100
Subject: [PATCH 1/3] Add dyndir config option to pathnames file
Signed-off-by: Sven Hartge
---
debian/split_config | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/debian/split_config b/debian/split_config
index 2b6bb95..00443b9 100755
--- a/debian/split_config
+++ b/debian/split_config
@@ -14,8 +14,8 @@ do
fi
done
-egrep 'sendmail|imgcache|imgurl|datadir|piddir|smokemail|tmail' ${DESTDIR}/etc/smokeping/config.d/General > ${DESTDIR}/etc/smokeping/config.d/pathnames
+egrep 'sendmail|imgcache|imgurl|datadir|dyndir|piddir|smokemail|tmail' ${DESTDIR}/etc/smokeping/config.d/General > ${DESTDIR}/etc/smokeping/config.d/pathnames
-sed -i '/sendmail\|imgcache\|imgurl\|datadir\|piddir\|smokemail\|tmail/d' ${DESTDIR}/etc/smokeping/config.d/General
+sed -i '/sendmail\|imgcache\|imgurl\|datadir\|dyndir\|piddir\|smokemail\|tmail/d' ${DESTDIR}/etc/smokeping/config.d/General
echo '@include /etc/smokeping/config.d/pathnames' >> ${DESTDIR}/etc/smokeping/config.d/General
--
2.15.0
From 0137ed9f2d03f064f36c7f18be65791d509e9fcb Mon Sep 17 00:00:00 2001
From: Sven Hartge
Date: Tue, 28 Nov 2017 21:21:35 +0100
Subject: [PATCH 2/3] Build-Depend on rename to fix #826056
Signed-off-by: Sven Hartge
---
debian/control | 1 +
1 file changed, 1 insertion(+)
diff --git a/debian/control b/debian/control
index 9933376..eb9a18d 100644
--- a/debian/control
+++ b/debian/control
@@ -8,6 +8,7 @@ Build-Depends: debhelper (>= 7.0.50~)
, dh-autoreconf
, dh-apache2
, apache2-dev
+ , rename
Build-Depends-Indep: librrds-perl
, groff-base
, libhtml-parser-perl
--
2.15.0
From a23fcfa8f6d434c5ec96da73605ae22b29cea2ed Mon Sep 17 00:00:00 2001
From: Sven Hartge
Date: Tue, 28 Nov 2017 21:37:16 +0100
Bug#760945: postinst overwrites permissions set by admin, destroys configuration for slaves
Control: tag -1 +help On Wed, Oct 21, 2015 at 08:33:39PM +0200, Christoph Berg wrote: > Re: Sven Hartge 2014-09-09 <540f1207.7000...@svenhartge.de> > > > Also the directory /var/lib/smokeping needs to be writable by www-data > > > to allow the data submitted by the slaves to be written to the RRD > > > files or you will get errors like this in the Apache error log: > > > > > > smokeping.cgi [client 10.1.1.32]: Could not update > > > /var/lib/smokeping//Remote/Campus_Remote/swXXX-remote-v1.smoke-slave.slave_cache, > > > giving up for now. at /usr/share/perl5/Smokeping/Master.pm line 156. > > > > Correction: The permissions for /var/lib/smokeping are fine, but the > > default configuration is missing the "dyndir" directive causing the CGI > > trying to write into the datadir instead of the correct directory > > /var/lib/smokeping/__cgi. > > I ran into this as well, it would be nice if the package got fixed. > The default /var/lib/smokeping/__cgi permissions need to be adjusted > as well: > drwxrwsr-x 4 smokeping www-data 4096 Okt 21 20:24 /var/lib/smokeping/__cgi So I'm not sure I follow all the proposed changes here. I don't feel like prompting the user for permissions is reasonable, at least not at a high priority. If you want to implement that, go ahead, in the `config` script with a `low` priority so it can be preseeded or something. But then I wonder if something couldn't be done with `dpkg-statoverride` - wouldn't that solve your problem? Also, we may be able to differentiate the configuration of slave and master packages, a split that has been proposed years ago but never implemented (#656369). In any case, I would like someone to propose a patch here so we can move ahead. It looks like permissions are set here: https://anonscm.debian.org/cgit/collab-maint/smokeping.git/tree/debian/postinst I would very much welcome a simple proposed modification to this file if permissions can be improved directly. Otherwise there would need to be changes encompassing more files (e.g. config) if we want debconf help. A. signature.asc Description: PGP signature
Bug#760945: postinst overwrites permissions set by admin, destroys configuration for slaves
On 22.05.2016 00:25, Iustin Pop wrote:
>> ,
>> | chown smokeping:smokeping /var/lib/smokeping
>> | chown smokeping:smokeping /etc/smokeping/smokeping_secrets
>> | chmod 640 /etc/smokeping/smokeping_secrets
>> `
>>
>> This unconditionally destroys any custom permissions the admin may have
>> set. Overwriting the permissions for /etc/smokeping/smokeping_secrets is
>> especially desastrous because this file needs to be read by the www-data
>> user (or group) to allow slaves to connect correctly.
>>
>> Right now the only option is to use POSIX-ACLs to allow www-data to read
>> that file because if you just use "chgrp www-data" this change will get
>> overwritten the next time the package is updated.
>
> Since there's no mechanism (AFAIK) for automatically handling custom
> permissions for conffiles, and both the admin and the package fight over
> this, the first solution that comes to mind is to add debconf questions
> for owner and mode, and always use debconf/the package to manage the
> permissions. This would solve both problems (conflicts and custom
> permissions).
>
> A simpler alternative but not that flexible would be to add only one
> question ("support slaves"), which would different, but still hard-coded
> permissions.
In https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760945#12 I
corrected my statement concerning the direcory /var/lib/smokeping, but
the wrong permissions for /etc/smokeping/smokeping_secrets remain.
Since this file is only ever needed on the server side (and unused if
you don't have slaves), you can (AFAICS) unconditionally ust set the
ownership to smokeping:www-data and set 640 as permissions and be done,
no need to ask anything.
The slave itself uses /etc/smokeping/slave-secrets as source for the
password, smokeping:root and 640 are correct there and can stay that way.
Grüße,
Sven.
signature.asc
Description: OpenPGP digital signature
Bug#760945: postinst overwrites permissions set by admin, destroys configuration for slaves
On 2014-09-09 13:29:28, Sven Hartge wrote:
> Package: smokeping
> Version: 2.6.9-1
> Severity: normal
>
> Hi!
>
> In the postinst the following commands are executed:
>
> ,
> | chown smokeping:smokeping /var/lib/smokeping
> | chown smokeping:smokeping /etc/smokeping/smokeping_secrets
> | chmod 640 /etc/smokeping/smokeping_secrets
> `
>
> This unconditionally destroys any custom permissions the admin may have
> set. Overwriting the permissions for /etc/smokeping/smokeping_secrets is
> especially desastrous because this file needs to be read by the www-data
> user (or group) to allow slaves to connect correctly.
>
> Right now the only option is to use POSIX-ACLs to allow www-data to read
> that file because if you just use "chgrp www-data" this change will get
> overwritten the next time the package is updated.
Since there's no mechanism (AFAIK) for automatically handling custom
permissions for conffiles, and both the admin and the package fight over
this, the first solution that comes to mind is to add debconf questions
for owner and mode, and always use debconf/the package to manage the
permissions. This would solve both problems (conflicts and custom
permissions).
A simpler alternative but not that flexible would be to add only one
question ("support slaves"), which would different, but still hard-coded
permissions.
Thoughts?
iustin
signature.asc
Description: PGP signature
Bug#760945: postinst overwrites permissions set by admin, destroys configuration for slaves
Re: Sven Hartge 2014-09-09 <540f1207.7000...@svenhartge.de> > > Also the directory /var/lib/smokeping needs to be writable by www-data > > to allow the data submitted by the slaves to be written to the RRD > > files or you will get errors like this in the Apache error log: > > > > smokeping.cgi [client 10.1.1.32]: Could not update > > /var/lib/smokeping//Remote/Campus_Remote/swXXX-remote-v1.smoke-slave.slave_cache, > > giving up for now. at /usr/share/perl5/Smokeping/Master.pm line 156. > > Correction: The permissions for /var/lib/smokeping are fine, but the > default configuration is missing the "dyndir" directive causing the CGI > trying to write into the datadir instead of the correct directory > /var/lib/smokeping/__cgi. I ran into this as well, it would be nice if the package got fixed. The default /var/lib/smokeping/__cgi permissions need to be adjusted as well: drwxrwsr-x 4 smokeping www-data 4096 Okt 21 20:24 /var/lib/smokeping/__cgi Christoph -- c...@df7cb.de | http://www.df7cb.de/ signature.asc Description: Digital signature
Bug#760945: postinst overwrites permissions set by admin, destroys configuration for slaves
Package: smokeping Version: 2.6.9-1 Severity: normal Hi! In the postinst the following commands are executed: , | chown smokeping:smokeping /var/lib/smokeping | chown smokeping:smokeping /etc/smokeping/smokeping_secrets | chmod 640 /etc/smokeping/smokeping_secrets ` This unconditionally destroys any custom permissions the admin may have set. Overwriting the permissions for /etc/smokeping/smokeping_secrets is especially desastrous because this file needs to be read by the www-data user (or group) to allow slaves to connect correctly. Right now the only option is to use POSIX-ACLs to allow www-data to read that file because if you just use chgrp www-data this change will get overwritten the next time the package is updated. Also the directory /var/lib/smokeping needs to be writable by www-data to allow the data submitted by the slaves to be written to the RRD files or you will get errors like this in the Apache error log: smokeping.cgi [client 10.1.1.32]: Could not update /var/lib/smokeping//Remote/Campus_Remote/swXXX-remote-v1.smoke-slave.slave_cache, giving up for now. at /usr/share/perl5/Smokeping/Master.pm line 156. Grüße, Sven. -- System Information: Debian Release: jessie/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (200, 'experimental') Architecture: i386 (x86_64) Foreign Architectures: amd64 Kernel: Linux 3.14-2-amd64 (SMP w/4 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages smokeping depends on: ii adduser 3.113+nmu3 ii debianutils 4.4 ii fping 3.10-2 ii libcgi-fast-perl1:2.02-1 ii libconfig-grammar-perl 1.10-2 ii libdigest-hmac-perl 1.03+dfsg-1 ii libjs-cropper 1.2.2-1 ii libjs-prototype 1.7.1-3 ii libjs-scriptaculous 1.9.0-2 ii librrds-perl1.4.8-1.1+b1 ii libsnmp-session-perl1.13-1.1 ii liburi-perl 1.64-1 ii libwww-perl 6.08-1 ii lsb-base4.1+Debian13 ii perl5.20.0-6 ii ucf 3.0030 Versions of packages smokeping recommends: ii apache2 2.4.10-1+b1 ii apache2-bin [httpd-cgi] 2.4.10-1+b1 ii apache2-mpm-prefork [httpd-cgi] 2.4.10-1+b1 ii apache2-mpm-worker [httpd-cgi] 2.4.10-1+b1 ii dnsutils 1:9.9.5.dfsg-4 ii echoping 6.0.2-8 ii libsocket6-perl 0.25-1+b1 Versions of packages smokeping suggests: ii curl 7.37.1-1 ii exim4 4.84-2 ii exim4-daemon-light [mail-transport-agent] 4.84-2 pn libauthen-radius-perl none ii libio-socket-ssl-perl 1.998-1 ii libnet-dns-perl0.79-2 pn libnet-ldap-perl none ii libnet-telnet-perl 3.04-1 ii openssh-client 1:6.6p1-7 -- Configuration Files: /etc/smokeping/apache2.conf changed [not included] /etc/smokeping/config.d/General changed [not included] /etc/smokeping/config.d/Probes changed [not included] /etc/smokeping/config.d/Slaves changed [not included] /etc/smokeping/config.d/Targets changed [not included] /etc/smokeping/config.d/pathnames changed [not included] /etc/smokeping/smokeping_secrets [Errno 13] Permission denied: u'/etc/smokeping/smokeping_secrets' -- debconf-show failed -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#760945: postinst overwrites permissions set by admin, destroys configuration for slaves
On Tue, 09 Sep 2014 13:29:28 +0200 Sven Hartge s...@svenhartge.de wrote: Also the directory /var/lib/smokeping needs to be writable by www-data to allow the data submitted by the slaves to be written to the RRD files or you will get errors like this in the Apache error log: smokeping.cgi [client 10.1.1.32]: Could not update /var/lib/smokeping//Remote/Campus_Remote/swXXX-remote-v1.smoke-slave.slave_cache, giving up for now. at /usr/share/perl5/Smokeping/Master.pm line 156. Correction: The permissions for /var/lib/smokeping are fine, but the default configuration is missing the dyndir directive causing the CGI trying to write into the datadir instead of the correct directory /var/lib/smokeping/__cgi. Grüße, Sven. signature.asc Description: OpenPGP digital signature
