ENT-14297: Improve error message when cf-agent cannot write to an immutable file (3.27)#6238
Open
nickanderson wants to merge 2 commits into
Open
ENT-14297: Improve error message when cf-agent cannot write to an immutable file (3.27)#6238nickanderson wants to merge 2 commits into
nickanderson wants to merge 2 commits into
Conversation
…-14297) Cover every path where cf-agent can fail to write a file because the immutable bit is set and is not being overridden, asserting that the error names the immutable bit: - content (14, fails at the in-place open) - edit_line (15) - copy_from (16) - mustache (17) fail at the temporary-file rename in - cfengine template (18) OverrideImmutableRename() - edit_xml (19) - inline_mustache (20) Each test drives a self-contained sub policy in its own agent process: the sub creates the target, sets the immutable bit via body fsattrs, and then attempts the modification. The test asserts on the captured output using native functions only (execresult_as_data + regcmp) and never fails on the sub's non-zero exit. Teardown clears the immutable bit natively. (cherry picked from commit 4d490e5)
…4297)
When cf-agent could not write a file whose immutable bit is set, the
error gave no reason. Now the actual system error is always reported, and
the immutable bit is called out explicitly when it is set (and not being
overridden):
error: Cannot open file '/tmp/x' for writing: Operation not permitted (the immutable bit is set)
error: Failed to replace original file '/tmp/x' with copy '...': Operation not permitted (the immutable bit is set)
The immutable annotation is confirmed via FSAttrsGetImmutableFlag(), not
guessed from errno (an immutable file typically fails with EPERM, but
that is not exclusive to immutability), so other causes (permissions, MAC
policy, a read-only or full filesystem) are never mislabeled.
The check lives at the two points where the write actually fails: the
in-place open in WriteContentFromString() (content), and the temporary-
file rename in OverrideImmutableRename(), which is the common landing
point for edit_line, edit_xml, copy_from and templating. It is skipped
when overriding the immutable bit, since then the agent writes to a
temporary copy that is renamed into place after clearing the bit.
(cherry picked from commit b9cab70)
nickanderson
changed the title
Member
Author
|
@cf-bottom jenkins please |
|
Alright, I triggered a build: Jenkins: https://ci.cfengine.com/job/pr-pipeline/14225/ Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-14225/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of ENT-14297 to
3.27.x(master PR: #6236).Improves the error message when cf-agent cannot write to a file whose immutable
bit is set and is not being overridden. The actual system error is always
reported, and
(the immutable bit is set)is appended only when confirmed viaFSAttrsGetImmutableFlag()— never guessed from errno (an immutable filetypically fails with
EPERM, but that is not exclusive to immutability), sopermission/MAC/read-only/full-filesystem failures are never mislabeled.
Detection lives at the two points where the write actually fails:
WriteContentFromString()— the in-place open for thecontentattribute.OverrideImmutableRename()— the temporary-file rename that is the commonlanding point for
edit_line,edit_xml,copy_from, and templating.It is skipped when overriding the immutable bit (the agent then writes to a
temporary copy renamed into place after clearing the bit).
Cherry-picked cleanly from master (
verify_files.cauto-merges; the sharedoverride_fsattrs.cis identical between 3.27.x and master).Tests (
tests/acceptance/10_files/unsafe/14..20_immutable_*) cover content,edit_line, copy_from, mustache, cfengine-template, edit_xml, and inline_mustache.
They are
unsafetests (they set the immutable bit), so they run in the chrootacceptance job (
UNSAFE_TESTS=1), not the GitHub Actions--tests=common,errorlog,errorexitrun.Ticket: ENT-14297