Bug 788707

Summary:	apcupsd initscript deletes /etc/nologin
Product:	[Fedora] Fedora EPEL	Reporter:	Howard Powell <hbp4c>
Component:	apcupsd	Assignee:	Michal Hlavinka <mhlavink>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	el6	CC:	mhlavink
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	apcupsd-3.14.8-4.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-08 17:26:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Howard Powell 2012-02-08 20:57:40 UTC

Description of problem:

If a system has an /etc/nologin file in place to prevent users from logging in, during apcupsd startup this script is automatically removed by the initscript (line 27).  

Deleting this file, if put in place by the system administrator, undermines his or her intentions to lock out users from a machine while maintenance is occuring.

Note that apcupsd also will attempt modify /etc/nologin, but this behavior can be disabled by changing the "NOLOGINDIR" variable in /etc/apcupsd/apcupsd.conf to something other that /etc.




Version-Release number of selected component (if applicable):

apcupsd-3.4.18




How reproducible:

Every time apcupsd restarts it will automatically rm -f /etc/nologin as part of startup.



Steps to Reproduce:
1.  touch /etc/nologin
2.  service apcupsd start (or restart)
 



Actual results:

/etc/nologin has been removed and no longer prevents normal users attempting to login.




Expected results:

/etc/nologin should remain in place if it exists before apcupsd starts.



Additional info:

Previous versions of apcupsd did not have this behavior but this happens on both el5 and el6 with apcupsd-3.4.18.

Comment 1 Michal Hlavinka 2012-02-09 11:19:08 UTC

apcupsd creates nologin file in some cases, that's the reason it cleans it up later. Otherwise users won't be able to log in after power failure reboot. It's designed to work this way by upstream and I'm not going to change this.

Comment 2 Howard Powell 2012-02-09 20:22:28 UTC

Hi Michal - thank you for responding to my bug.

A nologin file is automatically deleted by the system on reboot, there is no need to explicitly put it in the init file for apcupsd.  The only thing that the rm -f /etc/nologin command in the init script is doing is reduce security and confuse overworked system administrators.  

Thank you again for looking at this.

Comment 3 Howard Powell 2012-02-09 21:00:07 UTC

Perhaps a compromise would be to grep /etc/apcupsd/apcupsd.conf for the value of $NOLOGINDIR, and delete any nologin file within that directory.  This limits the init script to the exact same behavior that the apcupsd program itself will generate and not conflict with anything a sysadmin is trying to do.

Thanks again.

Comment 4 Michal Hlavinka 2012-02-10 12:16:51 UTC

Ok, we don't remove nologin in systemd and there was no complain ever, so it probably works fine with that. I'll remove that from init script.

Comment 5 Fedora Update System 2012-02-10 13:34:52 UTC

apcupsd-3.14.8-4.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/apcupsd-3.14.8-4.el6

Comment 6 Fedora Update System 2012-02-10 18:36:04 UTC

Package apcupsd-3.14.8-4.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing apcupsd-3.14.8-4.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-0411/apcupsd-3.14.8-4.el6
then log in and leave karma (feedback).

Comment 7 Fedora Update System 2012-03-08 17:26:51 UTC

apcupsd-3.14.8-4.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.