[Bug 1765191] Re: [SRU] (13)Permission denied: [client 1.2.3.4:60750] AH00035: access to /static/dashboard/img/favicon.ico denied (filesystem path '/var/lib/openstack-dashboard/static') because search permissions are missing on a component of the path
Felipe Reyes
1765191 at bugs.launchpad.net
Thu May 24 01:35:23 UTC 2018
Upgraded successfully from xenial-mitaka to artful-pike, no regressions
were detected (login, assets are loading, router creation works among
other operations).
root at juju-dfc611-artful-8:~# apt policy openstack-dashboard
openstack-dashboard:
Installed: 3:12.0.2-0ubuntu1
Candidate: 3:12.0.2-0ubuntu1
Version table:
*** 3:12.0.2-0ubuntu1 500
500 http://nova.clouds.archive.ubuntu.com/ubuntu artful-updates/main amd64 Packages
100 /var/lib/dpkg/status
3:12.0.0-0ubuntu2.1 500
500 http://nova.clouds.archive.ubuntu.com/ubuntu artful/main amd64 Packages
root at juju-dfc611-artful-8:~# ls -ld /var/lib/openstack-dashboard/
drwx------ 4 horizon horizon 4096 May 24 00:55 /var/lib/openstack-dashboard/
root at juju-dfc611-artful-8:~# ls -l /var/lib/openstack-dashboard/
total 12
-rw------- 1 horizon horizon 64 May 23 23:57 secret_key
drwxr-xr-x 2 horizon horizon 4096 Feb 2 20:24 secret-key
drwxr-xr-x 11 horizon horizon 4096 May 24 00:55 static
-rw-r--r-- 1 horizon horizon 0 May 23 23:57 _var_lib_openstack-dashboard_secret_key.lock
root at juju-dfc611-artful-8:~# vim /etc/apt/sources.list
root at juju-dfc611-artful-8:~# apt-get -qq update
root at juju-dfc611-artful-8:~# apt-get upgrade
...
Setting up openstack-dashboard-ubuntu-theme (3:12.0.2-0ubuntu1.1) ...
Processing triggers for initramfs-tools (0.125ubuntu12.1) ...
update-initramfs: Generating /boot/initrd.img-4.13.0-43-generic
WARNING: Setting CRYPTSETUP in /etc/initramfs-tools/initramfs.conf is deprecated and will stop working in the future. Use /etc/cryptsetup-initramfs/conf-hook instead.
Processing triggers for libc-bin (2.26-0ubuntu2.1) ...
root at juju-dfc611-artful-8:~# apt policy openstack-dashboard
openstack-dashboard:
Installed: 3:12.0.2-0ubuntu1.1
Candidate: 3:12.0.2-0ubuntu1.1
Version table:
*** 3:12.0.2-0ubuntu1.1 500
500 http://nova.clouds.archive.ubuntu.com/ubuntu artful-proposed/main amd64 Packages
100 /var/lib/dpkg/status
3:12.0.2-0ubuntu1 500
500 http://nova.clouds.archive.ubuntu.com/ubuntu artful-updates/main amd64 Packages
3:12.0.0-0ubuntu2.1 500
500 http://nova.clouds.archive.ubuntu.com/ubuntu artful/main amd64 Packages
root at juju-dfc611-artful-8:~# ls -ld /var/lib/openstack-dashboard/
drwxr-xr-x 4 horizon horizon 4096 May 24 01:27 /var/lib/openstack-dashboard/
root at juju-dfc611-artful-8:~# ls -ld /var/lib/openstack-dashboard/
drwxr-xr-x 4 horizon horizon 4096 May 24 01:27 /var/lib/openstack-dashboard/
root at juju-dfc611-artful-8:~# pastebinit /var/log/apt/history.log
http://paste.ubuntu.com/p/42fdRNjbx5/
root at juju-dfc611-artful-8:~# pastebinit /var/log/apt/term.log
http://paste.ubuntu.com/p/RFvg6G6rzv/
** Tags removed: verification-needed-artful
** Tags added: verification-done-artful
--
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to horizon in Ubuntu.
https://bugs.launchpad.net/bugs/1765191
Title:
[SRU] (13)Permission denied: [client 1.2.3.4:60750] AH00035: access to
/static/dashboard/img/favicon.ico denied (filesystem path '/var/lib
/openstack-dashboard/static') because search permissions are missing
on a component of the path
Status in Ubuntu Cloud Archive:
Fix Committed
Status in Ubuntu Cloud Archive ocata series:
Fix Committed
Status in Ubuntu Cloud Archive pike series:
Fix Committed
Status in Ubuntu Cloud Archive queens series:
Fix Committed
Status in horizon package in Ubuntu:
Fix Released
Status in horizon source package in Artful:
Fix Committed
Status in horizon source package in Bionic:
Fix Committed
Status in horizon source package in Cosmic:
Fix Released
Bug description:
[Impact]
When upgrading from mitaka to pike horizon stops working because
Apache can't read the static assets anymore
[Wed Apr 04 11:22:37.470451 2018] [core:error] [pid 17924:tid
140071592240896] (13)Permission denied: [client 1.2.3.4:60750]
AH00035: access to /static/dashboard/img/favicon.ico denied
(filesystem path '/var/lib/openstack-dashboard/static') because search
permissions are missing on a component of the path
In xenial the home for the horizon user is /usr/share/openstack-
dashboard, and /var/lib/openstack-dashboard permissions are changed to
700 to secure the secret_key, while in artful/pike only the secret_key
file is set to 700
# ls -ld /var/lib/openstack-dashboard/
drwxr-xr-x 4 horizon horizon 4096 Apr 18 18:49 /var/lib/openstack-dashboard/
# ls -ld /var/lib/openstack-dashboard/secret_key
-rw------- 1 horizon horizon 64 Apr 18 18:47 /var/lib/openstack-dashboard/secret_key
# apt-cache policy openstack-dashboard
openstack-dashboard:
Installed: 3:12.0.2-0ubuntu1
Candidate: 3:12.0.2-0ubuntu1
Version table:
*** 3:12.0.2-0ubuntu1 500
500 http://nova.clouds.archive.ubuntu.com/ubuntu artful-updates/main amd64 Packages
100 /var/lib/dpkg/status
3:12.0.0-0ubuntu2.1 500
500 http://nova.clouds.archive.ubuntu.com/ubuntu artful/main amd64 Packages
So during the upgrade of the package /var/lib/openstack-dashboard is
left to 700
xenial -> debian/openstack-dashboard.postinst
...
if [ -d /var/lib/openstack-dashboard ] ; then
# Generated secret storage for single node use - see local_settings.py
# for more details of SECRET_KEY
chmod 0700 /var/lib/openstack-dashboard
if [ -f /etc/openstack-dashboard/secret_key ]; then
mv /etc/openstack-dashboard/secret_key /var/lib/openstack-dashboard
fi
chown -R horizon:horizon /var/lib/openstack-dashboard
fi
....
artful -> debian/openstack-dashboard.postinst
...
if ! getent passwd horizon > /dev/null 2>&1 ; then
adduser --system --home /var/lib/openstack-dashboard --ingroup horizon \
--no-create-home --shell /bin/false horizon
fi
...
[Test Case]
* deploy openstack
juju deploy ./xenial-mitaka.yaml # http://paste.ubuntu.com/p/7XtXRvf4cT/
* upgrade openstack-dashboard to ocata, pike or queens
juju deploy openstack-dashboard openstack-origin="cloud:xenial-ocata" # for -proposed use "cloud:xenial-ocata/proposed"
Expected result:
http://`juju-deployer -f openstack-dashboard`/horizon/auth/login is
displayed with all the correct css/js/etc assets
Actual result:
http://`juju-deployer -f openstack-dashboard`/horizon/auth/login
cannot load the static assets (javascript/css/etc)
[Regression Potential]
* Users who may have customized /var/lib/openstack-dashboard
permissions to comply with some specific security policy will see
changes in the permissions when they upgrade, but this is a common
situation when packages are upgraded.
[Other Info]
N/A
To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1765191/+subscriptions
More information about the Ubuntu-openstack-bugs
mailing list