DescriptionMikel Olasagasti
2018-08-29 10:54:24 UTC
When umask is more restrictive than default, 0022 vs 0027, /var/www/cgi-bin/nova is created with insufficient permissions.
[root@new-deployment ~]# umask
0027
[root@new-deployment conf.d]# ls -las /var/www/cgi-bin/nova
total 12
4 drwxr-x---. 2 nova nova 4096 ago 29 10:11 .
4 drwxr-xr-x. 4 root root 4096 ago 29 10:12 ..
4 -rw-r--r--. 1 nova nova 1252 ago 29 10:11 nova-api
[root@new-deployment ~]# nova list
ERROR (Forbidden): Forbidden (HTTP 403)
[root@new-deployment ~]# grep AH00035 /var/log/httpd/nova_api_wsgi_access.log
[Wed Aug 29 11:05:46.352740 2018] [core:error] [pid 15972] (13)Permission denied: [client 172.28.4.3:42610] AH00035: access to /v2.1 denied (filesystem path '/var/www/cgi-bin/nova/nova-api') because search permissions are missing on a component of the path
[root@old-deployment ~]# umask
0022
[root@old-deployment conf.d]# ls -las /var/www/cgi-bin/nova
total 4
0 drwxr-xr-x. 2 nova nova 22 feb 19 2018 .
0 drwxr-xr-x. 4 root root 34 feb 19 2018 ..
4 -rw-r--r--. 1 nova nova 1252 feb 19 2018 nova-api
Fix file permissions:
[root@new-deployment conf.d]# chmod 755 /var/www/cgi-bin/nova
[root@new-deployment conf.d]# source ~/stackrc
[root@new-deployment conf.d]# nova list
+----+------+--------+------------+-------------+----------+
| ID | Name | Status | Task State | Power State | Networks |
+----+------+--------+------------+-------------+----------+
+----+------+--------+------------+-------------+----------+
$ egrep "python-tripleo|instack" installed-rpms
instack-5.1.0-1.el7ost.noarch
instack-undercloud-5.3.7-1.el7ost.noarch
python-tripleoclient-5.4.6-1.el7ost.noarch
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2020:0760