Bug 704653

Summary:	Misleading/wrong error message on cumin service start by unprivileged user.
Product:	Red Hat Enterprise MRG	Reporter:	Trevor McKay <tmckay>
Component:	cumin	Assignee:	Trevor McKay <tmckay>
Status:	CLOSED ERRATA	QA Contact:	Jan Sarenik <jsarenik>
Severity:	low	Docs Contact:
Priority:	low
Version:	2.0	CC:	jneedle, jsarenik, matt
Target Milestone:	2.0.1
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	cumin-0.1.4840-1	Doc Type:	Bug Fix
Doc Text:	The cumin service init script must be run as the root user. However, the script lacked a check to ensure that it was run by the root user, with the result that running the script as an unprivileged user resulted in misleading error messages. With this update, the script fails immediately (and displays "[FAILED]") when it is run as an unprivileged user.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-09-07 18:17:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	723887

Description Trevor McKay 2011-05-13 20:55:22 UTC

Description of problem:

Running "service cumin start" as an unprivileged user gives misleading error messages.  It complains that postgresql is not running, even if it is.  Find out exactly what is happening here, maybe find a better message.

4:38:26pm> eeyore:cumin/MRG-RHEL-6/cumin-0.1.4746 $ service cumin restart
Cumin's database server is not running
Run 'cumin-database start' as root
04:38:30pm> eeyore:cumin/MRG-RHEL-6/cumin-0.1.4746 $ sudo service cumin restart
Stopping cumin:                                            [  OK  ]
Starting cumin:

Comment 1 Trevor McKay 2011-05-23 17:14:01 UTC

After poking around, this is related to a general issue in RHEL 5, the SysVinit component.  Specificaly, the use of the "-c" option to pidof causes /sbin/service postgresql status to say that it's not running.

In the BZ below, the resolution seems to be to change init.d/functions so that it warns when privileges are required for a particular operation.  If that fix works, then in the particular cumin case the user should be warned that insufficient privilege exists to start cumin.

https://bugzilla.redhat.com/show_bug.cgi?id=684881

Comment 3 Trevor McKay 2011-05-25 14:34:14 UTC

Grabbed latest SysVinit package (SysVinit-2.86-17.el5), pidof -c has been fixed.

So, that particular issue will be repaired, however cumin checks for root user in cumin-database script used during startup, so the error messages are still misleading.  Fix coming....

Comment 4 Trevor McKay 2011-05-25 14:54:13 UTC

Fixed in revision 4786.

Comment 5 Trevor McKay 2011-05-25 15:00:25 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:
  Scripts used during Cumin service start up must be run as the root user.  However, the root user check is missing in the Cumin SysVinit script.

Consequence:
  Attempting to start the cumin service as a non-root user gives misleading error messages, when the real problem is that the user is not root.

Fix:
  Add a root user check to the SysVinit script.  Mark the service start [FAILED] with an explanation if the user is not root.

Result:
  Non-root users will now be given accurate information on why the service start failed.

Comment 6 Trevor McKay 2011-05-25 15:22:43 UTC

For testing:

  Additional checks added to start case (includes start, restart, condrestart) and stop (if cumin was running).  These commands as a non-root user should FAIL with the the message "Must be root".

  Status should work as an unprivileged user as long as SysVinit-2.86-17.el5 or later is installed.

Comment 7 Jan Sarenik 2011-06-21 14:47:19 UTC

cumin-0.1.4840-1.el6.noarch

$ service cumin start
Starting cumin:                                            [FAILED]
Must be run as root

Comment 8 Douglas Silas 2011-08-08 14:31:02 UTC

    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1,11 +1 @@
-Cause:
+The cumin service init script must be run as the root user. However, the script lacked a check to ensure that it was run by the root user, with the result that running the script as an unprivileged user resulted in misleading error messages. With this update, the script fails immediately (and displays "[FAILED]") when it is run as an unprivileged user.-  Scripts used during Cumin service start up must be run as the root user.  However, the root user check is missing in the Cumin SysVinit script.
-
-Consequence:
-  Attempting to start the cumin service as a non-root user gives misleading error messages, when the real problem is that the user is not root.
-
-Fix:
-  Add a root user check to the SysVinit script.  Mark the service start [FAILED] with an explanation if the user is not root.
-
-Result:
-  Non-root users will now be given accurate information on why the service start failed.