Bug 2238348

Summary: when creating a backup on rhel7 and restoring on rhel8, the restore process will fail with permission issues
Product: Red Hat Satellite Reporter: Odilon Sousa <osousa>
Component: Satellite MaintainAssignee: Evgeni Golov <egolov>
Status: CLOSED ERRATA QA Contact: Lukas Pramuk <lpramuk>
Severity: high Docs Contact:
Priority: high    
Version: 6.11.0CC: ahumbe, bhoefer, egolov, ehelms, jpasqual, jpathan, kurathod, lpramuk, mkalyat, pcreech, pdwyer, pratshar, satellite6-bugs, saydas
Target Milestone: 6.13.5Keywords: Triaged
Target Release: Unused   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: rubygem-foreman_maintain-1.2.12-1.el8sat Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 2159839 Environment:
Last Closed: 2023-10-19 13:13:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Comment 2 Lukas Pramuk 2023-10-03 15:22:34 UTC
VERIFIED.

@Satellite 6.13.5 Snap 2
rubygem-foreman_maintain-1.2.12-1.el8sat.noarch

by the following manual reproducer:

1) Enable katello-agent feature 
# satellite-installer --foreman-proxy-content-enable-katello-agent true

2) Create a backup
# satellite-maintain backup offline -y /var/backup

3) Check qpidd user UID and GID
# id qpidd
uid=986(qpidd) gid=984(qpidd) groups=984(qpidd)

4) On another machine with the same hostname install satellite with the defaults
(=katello-agent is disabled and not installed)

5) Add a dummy system group and user so they take over the original UID/GID (986/984)
# groupadd --system monitoring
# useradd --system -g  monitoring monitoring
# id monitoring
uid=986(monitoring) gid=984(monitoring) groups=984(monitoring)

6) Restore from the backup made on 1st machine

REPRO:

# satellite-maintain restore -y /var/backup/satellite-backup-2023-09-22-07-03-49
...
--------------------------------------------------------------------------------
Restore configs from backup: 
- Restoring configs                                                   [OK]      
--------------------------------------------------------------------------------
Run installer reset: 
| Installer reset                                                     [FAIL]    
Failed executing yes | satellite-installer -v --reset-data , exit status 6:
...
2023-10-03 10:38:49 [ERROR ] [configure] Systemd start for qpidd failed!
2023-10-03 10:38:49 [ERROR ] [configure] journalctl log for qpidd:
2023-10-03 10:38:49 [ERROR ] [configure] -- Logs begin at Tue 2023-10-03 07:02:38 EDT, end at Tue 2023-10-03 10:38:49 EDT. --
2023-10-03 10:38:49 [ERROR ] [configure] Oct 03 10:37:19 satellite.example.com systemd[1]: Starting An AMQP message broker daemon....
2023-10-03 10:38:49 [ERROR ] [configure] Oct 03 10:37:19 satellite.example.com qpidd[38819]: 2023-10-03 10:37:19 [Broker] critical Unexpected error: Cannot open lock file /var/lib/qpidd/lock: Permission denied
2023-10-03 10:38:49 [ERROR ] [configure] Oct 03 10:37:19 satellite.example.com qpidd[38819]: 2023-10-03 10:37:19 [Broker] critical Unexpected error: Cannot open lock file /var/lib/qpidd/lock: Permission denied
2023-10-03 10:38:49 [ERROR ] [configure] Oct 03 10:37:19 satellite.example.com systemd[1]: qpidd.service: Main process exited, code=exited, status=1/FAILURE
2023-10-03 10:38:49 [ERROR ] [configure] Oct 03 10:38:49 satellite.example.com systemd[1]: qpidd.service: Start-post operation timed out. Stopping.
2023-10-03 10:38:49 [ERROR ] [configure] Oct 03 10:38:49 satellite.example.com systemd[1]: qpidd.service: Failed with result 'exit-code'.
2023-10-03 10:38:49 [ERROR ] [configure] Oct 03 10:38:49 satellite.example.com systemd[1]: Failed to start An AMQP message broker daemon..
2023-10-03 10:38:49 [ERROR ] [configure] /Stage[main]/Qpid::Service/Service[qpidd]/ensure: change from 'stopped' to 'running' failed: Systemd start for qpidd failed!

# ll /var/lib/qpidd/lock
-rw-r--r--. 1 monitoring monitoring 0 Sep 22 06:44 /var/lib/qpidd/lock


vs.


FIX:

# satellite-maintain restore -y /var/backup/satellite-backup-2023-09-22-07-03-49
...
--------------------------------------------------------------------------------
Ensure required packages are installed before restore: 
/ Installing required packages                                        [OK]      
--------------------------------------------------------------------------------
Restore configs from backup: 
/ Restoring configs                                                   [OK]      
--------------------------------------------------------------------------------
Run installer reset: 
| Installer reset                                                     [OK]      
--------------------------------------------------------------------------------

# ll /var/lib/qpidd/lock
-rw-r--r--. 1 qpidd qpidd 0 Sep 22 06:44 /var/lib/qpidd/lock


>>> restore now ensures required users/groups exist prior restoring configs (in order to map users/groups in archive vs. in system)

Comment 9 errata-xmlrpc 2023-10-19 13:13:17 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.13.5 Async Security Update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:5931