Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: when configuring to use a qpidd user, packstack creates a sasldb (which is great!) Sadly, the file is not accessible for the qpidd user: [root@turing ~(keystone_admin)]# ls -lZ /var/lib/qpidd/qpidd.sasldb -rw-r-----. root root unconfined_u:object_r:qpidd_var_lib_t:s0 /var/lib/qpidd/qpidd.sasldb [root@turing ~(keystone_admin)]# chown qpidd:qpidd /var/lib/qpidd/qpidd.sasldb [root@turing ~(keystone_admin)]# service qpidd restart fixes that issue. I expect this kind of issue to be in all packstack deployments, and it results in no service being able to authenticate with qpidd. The tested version is openstack-packstack-2013.2.1-0.27.dev936.fc21.noarch
In qpid::server Puppet class implementation sasldb is created with qpidd:qpidd ownership: https://github.com/dprince/puppet-qpid/blob/master/manifests/server.pp#L76 Isn't there any other way the ownership could be changed back to root? Would you be so kind and run packstack again with --debug and include <ip>_qpid.pp.log file from your /var/tmp/packstack/<timestamp>-<hash>/ directory?
Martin, that's the SSL certificate database, we're actually not ensuring that the /var/lib/qpidd/qpidd.sasldb is beign owned by the qpidd user. we create the user inside the qpidd.sasldb file but we don't ensure the ownership of the file. https://github.com/stackforge/packstack/blob/master/packstack/puppet/templates/qpid_auth.pp
Ah, ok. I mistaken those two, sorry for that.
problem fixed in this review: https://review.openstack.org/#/c/66169
awesome, thank you!
openstack-packstack-2013.2.1-0.29.dev956.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/openstack-packstack-2013.2.1-0.29.dev956.fc20
openstack-packstack-2013.2.1-0.29.dev956.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.