+++ This bug was initially created as a clone of Bug #2182947 +++
Description of problem:
When linking the '/etc/udev/rules.d/70-persistent-net.rules' file to /dev/null to disable this udev rule, cloud-init still tries to write this file and modify the permission, which causes the permission changes of /dev/null from 666 to 644. In this case, the non-root users will have no write permission to /dev/null.
This issue has been resolved upstream. The commit summary is as below:
------------------------------
commit 56c88cafd1b3606e814069a79f4ec265fc427c87
Author: James Falcon <james.falcon>
Date: Thu Mar 23 10:21:56 2023 -0500
Don't change permissions of netrules target (#2076)
Set permissions if file doesn't exist. Leave them if it does.
LP: #2011783
Co-authored-by: Chad Smith <chad.smith>
--------------------------------
Version-Release number of selected components (if applicable):
cloud-init-22.1-8.el8.noarch
How reproducible:
100%
Steps to Reproduce:
1. Create an instance with RHEL-8.8 guest image on PSI OpenStack env
2. Create the symbolic link file as follows
# ln -sf /dev/null /etc/udev/rules.d/70-persistent-net.rules
# ll /etc/udev/rules.d/
total 0
lrwxrwxrwx. 1 root root 9 Mar 29 05:32 70-persistent-net.rules -> /dev/null
3. Rerun cloud-init
# cloud-init clean
# reboot
4. Login to the instance and check the mode of /dev/null
# ll /dev/null
crw-r--r--. 1 root root 1, 3 Mar 29 05:33 /dev/null
The mode bits have been changed from 666 to 644. And the non-root users will hit "/dev/null: Permission denied" error.
5. Check the cloud-init log
# cat /var/log/cloud-init.log
...
util.py[DEBUG]: Writing to /etc/udev/rules.d/70-persistent-net.rules - wb: [644] 96 bytes
Actual results:
As above
Expected results:
Backport the upstream patch to fix this issue
Additional info:
This issue also exists in RHEL9.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: cloud-init security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2023:6371