Bug 1044683

Summary: If /etc/sudoers does not contain "#includedir /etc/sudoers.d" then cinder, neutron and nova OpenStack services will fail
Product: Red Hat OpenStack Reporter: Vinny Valdez <vvaldez>
Component: openstack-packstackAssignee: RHOS Maint <rhos-maint>
Status: CLOSED WONTFIX QA Contact: Ami Jeain <ajeain>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 4.0CC: aortega, derekh, ichavero, mmagr, yeylon
Target Milestone: ---   
Target Release: 5.0 (RHEL 7)   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-24 20:25:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Vinny Valdez 2013-12-18 19:45:51 UTC
Description of problem:
In an environment that uses managed /etc/sudoers file that does not contain the statement"#includedir /etc/sudoers.d" then several OpenStack services that have custom sudo rules will fail as those files will not be read.

Version-Release number of selected component (if applicable):
openstack-packstack-2013.2.1-0.11.dev847.el6ost.noarch

How reproducible:
Everytime with this version

Steps to Reproduce:
1. Remove the "#includedir /etc/sudoers.d" statement from /etc/sudoers
2. Install OpenStack via PackStack
3. Attempt to use cinder, neutron, or nova

Actual results:
From the /var/log/neutron/openvswitch-agent.log
Command: ['sudo', 'neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ovs-vsctl', '--timeout=2', 'get', 'Interface', 'patch-int', 'ofport']
Stderr: 'sudo: no tty present and no askpass program specified\n'
 
Expected results:
PackStack (or whatever installer is used) should check /etc/sudoers for the presence of:
#includedir /etc/sudoers.d

An appropriate action should be taken if it is not present, halting or at least displaying a warning at the end of PackStack to warn the user.

Comment 2 Vinny Valdez 2013-12-18 21:21:57 UTC
Errors from cinder:
2013-12-18 13:01:20.197 32739 WARNING cinder.volume.drivers.glusterfs [req-cf3d3c09-3bc9-416b-981f-18ef6fc5eb9c None None] Exception during mounting Unexpected error while running command.
Command: sudo cinder-rootwrap /etc/cinder/rootwrap.conf mount -t glusterfs 10.205.20.3:/cinder /var/lib/cinder/mnt/99a4d8b40ccc6587f02fe7ad88d5f629
Exit code: 1
Stdout: ''
Stderr: 'sudo: no tty present and no askpass program specified\n'
2013-12-18 13:02:26.039 32739 WARNING cinder.volume.drivers.glusterfs [-] Exception during mounting Unexpected error while running command.
Command: sudo cinder-rootwrap /etc/cinder/rootwrap.conf mount -t glusterfs 10.205.20.3:/cinder /var/lib/cinder/mnt/99a4d8b40ccc6587f02fe7ad88d5f629
Exit code: 1
Stdout: ''
Stderr: 'sudo: no tty present and no askpass program specified\n'

Comment 3 Ivan Chavero 2014-02-06 21:12:14 UTC
Installing OpenStack using packstack on systems that have previous configuration is not recommended.
I recommend this bug to be close as NOTABUG.
What do you think Martin?

Comment 4 Vinny Valdez 2014-02-07 00:55:01 UTC
Just to clarify, these were freshly installed systems from Satellite. The /etc/sudoers file is managed as part of their corporate kickstart. It seems a packstack warning if the include statement is not present might be good enough to warn the user at least.

Comment 5 Martin Magr 2014-02-19 15:14:40 UTC
Well we can document this case, but I agree with Ivan. Packstack should not mess with sudoers file.

Perry, should we reassign this bug to some doc component?

Comment 6 Perry Myers 2014-02-19 15:27:02 UTC
I think a docs bug is needed yes, but to Vinny's point, I think a better warning would make sense.  This wouldn't mean that we mess with sudoers, but at least we could tell the user "Hey, you messed with the sudoers file and OpenStack will not work because of that"

I actually think that check probably belongs in the puppet modules, since the host that packstack is running on is not likely the host we care about this being broken on.  And also, we'd want this warning to be visible for Foreman as well, not just packstack

Comment 7 Alvaro Lopez Ortega 2014-06-24 20:25:23 UTC
It's doable (in 4 LOC). However, it'd be nasty hack in the Python part of packstack, and I'd rather not add something like that.

There is an endless number of ways to mess with a Linux system that will stop packstack from working, and I don't think we ought to try to check for them.

Am closing this bug as WONTFIX. Please, feel free to reopen it if you have strong feeling about getting this specific case covered.