Bug 1962757
| Summary: | /usr/share/foreman is not writable for satellite-installer | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Gaurav Talreja <gtalreja> |
| Component: | Installation | Assignee: | Ewoud Kohl van Wijngaarden <ekohlvan> |
| Status: | CLOSED ERRATA | QA Contact: | Devendra Singh <desingh> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.10.0 | CC: | ehelms, ekohlvan, pcreech |
| Target Milestone: | 6.10.0 | Keywords: | Triaged |
| Target Release: | Unused | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-16 14:11:01 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Gaurav Talreja
2021-05-20 15:11:33 UTC
This isn't really the installer. The root cause is related to CVE-2019-3881 (https://bugzilla.redhat.com/show_bug.cgi?id=1651826). In https://github.com/rubygems/bundler/commit/02e7f67727b45 it was changed to use a randomized directory if the home directory is not writable. For the foreman user the home directory /usr/share/foreman is not writable (for security reasons). foreman-rake is executed as the foreman user and the installer runs foreman-rake. For completeness, this also affects the foreman-proxy which can't write to /usr/share/foreman-proxy. This can be seen in the foreman-proxy service startup (journalctl -u foreman-proxy). A possible workaround is to create /var/lib/foreman{,-proxy}/.bundle and create a /usr/share/foreman{,proxy}/.bundle symlink. This would allow the Foreman (Proxy) user to write there. However, to code appears to really be checking the HOME, so it may not even work. In theory you can export a different HOME but other code may suddenly start to break if you do so. Some scripts may assume $HOME has the entire Rails code. Since this output is more of an implementation detail, could we hide it when executing foreman-rake ? Created redmine issue https://projects.theforeman.org/issues/33013 from this bug Bundler does appear to have Bundler.ui which can be set to Bundler::UI::Silent. However, I'm not really sure where we would set this. https://github.com/theforeman/foreman/blob/develop/script/foreman-rake is the source for foreman-rake (on EL7 RAKE_CMD is changed to /usr/bin/tfm-rake). It's a shell script that ends up calling plain rake. I suspect that adding some code to Rakefile doesn't work either because at that point it already has loaded the bundler environment. I've submitted https://github.com/theforeman/foreman/pull/8663 which may work but right now I don't have a test environment so I'll spin one up. Upstream bug assigned to ekohlvan Upstream bug assigned to ekohlvan Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/33013 has been resolved. Verified on 6.10 snap14 # satellite-installer 2021-08-20 13:09:47 [NOTICE] [root] Loading installer configuration. This will take some time. 2021-08-20 13:09:54 [NOTICE] [root] Running installer with log based terminal output at level NOTICE. 2021-08-20 13:09:54 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions. Package versions are locked. Continuing with unlock. ........................ ........................ 2021-08-20 13:12:23 [NOTICE] [configure] 3000 configuration steps out of 3029 steps complete. 2021-08-20 13:12:31 [NOTICE] [configure] System configuration has finished. Executing: foreman-rake upgrade:run 'ErbParser' is ignored. 'RubyParser' is ignored. ============================================= Upgrade Step 1/2: katello:correct_repositories. This may take a long while. Processing Repository 1/140: Red Hat Enterprise Linux 6 Server RPMs x86_64 6Server (2) Processing Repository 2/140: Red Hat Enterprise Linux 7 Server RPMs x86_64 7Server (4) ............... ............... Processing Repository 140/140: tools6_latest_repo_rhel6 (901) ============================================= Upgrade Step 2/2: katello:clean_backend_objects. This may take a long while. 0 orphaned consumer id(s) found in candlepin. Candlepin orphaned consumers: [] Success! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4702 |