Bug 1232668
| Summary: | ‘ cman_tool status ‘ fails when it is executed by non root user. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | deenajos |
| Component: | cluster | Assignee: | Christine Caulfield <ccaulfie> |
| Status: | CLOSED NOTABUG | QA Contact: | cluster-qe <cluster-qe> |
| Severity: | urgent | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.2 | CC: | ccaulfie, cluster-maint, rpeterso, stephenfmarshall, teigland |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-06-18 08:45:23 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The permissions on the cman client socket are deliberate - we really don't want any old process accessing the cluster manager. The socket permissions are 0660 which means you should be able to grant access to non-root processes by giving them access the appropriate group. The group defaults to 'root' too, but is easily changed. (In reply to Christine Caulfield from comment #2) > The permissions on the cman client socket are deliberate - we really don't > want any old process accessing the cluster manager. > > The socket permissions are 0660 which means you should be able to grant > access to non-root processes by giving them access the appropriate group. > The group defaults to 'root' too, but is easily changed. I'm experiencing the same problem as the original poster. I can solve the problem temporarily by changing the group ownership on the cman socket file. However, this solution is only temporary; it needs to be repeated if the system is rebooted or cman is restarted. Is there a way to configure cman so it will create its socket with group permissions other than root (e.g. with group haclient)? Below shows the details of the temporary solution, which may be useful for testing a more permanent solution. This command shows the problem. Executing this as a privileged user (e.g. root) has no errors. cman_tool nodes -F id,name cman_tool: Cannot open connection to cman, permission denied. The permissions on the cman socket file are exactly as the original poster described (writable to user and group, but user and group are both "root"). ls -ltr /var/run/cman_client srw-rw----. 1 root root 0 Jan 22 16:38 /var/run/cman_client I am able to fix the problem by changing the group permissions on the cman socket file, e.g. sudo chgrp haclient /var/run/cman_client Now users that are part of the haclient group can run this command successfully: cman_tool nodes -F id,name 1 qc-sfc-obs1 2 qc-sfc-obs2 |
Description of problem: When a non root user executes 'cman_tool status' , it fails with following error : [nonroot@xxx]$ /usr/sbin/cman_tool status /usr/sbin/cman_tool: Cannot open connection to cman, permission denied. On using strace, it was found that the failure was due to a permission issue with the file '/var/run/cman_client'. STRACE output for the command: socket(PF_FILE, SOCK_STREAM, 0) = 3 fcntl(3, F_SETFD, FD_CLOEXEC) = 0 connect(3, {sa_family=AF_FILE, path="/var/run/cman_client"}, 110) = -1 EACCES (Permission denied) close(3) = 0 write(2, "/usr/sbin/cman_tool: ", 21/usr/sbin/cman_tool: ) = 21 Similar issue is seen when 'cman_tool nodes' is run by the non root user. However, the command 'cman_tool services' is successfully executed by the same non root user. 1. Is this because root permissions are required by to execute the above commands? 2. If yes, how can this be made to work for a non root user?. Version-Release number of selected component (if applicable): cman-3.0.12.1-49.el6.x86_64 How reproducible: 100% Steps to Reproduce: 1.log in to the cluster as non root user . 2.Run 'cman_tool status'. Actual results: [nonroot@xxx]$ /usr/sbin/cman_tool status /usr/sbin/cman_tool: Cannot open connection to cman, permission denied. Expected results: 'cman_tool status' should give same results for the non root user as it does for the root/administrator. Additional info: