Bug 1964490 - After upgrading the oVirt node to 4.4.6 it's impossible to login through cockpit
Summary: After upgrading the oVirt node to 4.4.6 it's impossible to login through cockpit
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: imgbased
Classification: oVirt
Component: General
Version: 1.2.20
Hardware: x86_64
OS: Linux
high
high
Target Milestone: ovirt-4.4.7
: 1.2.21
Assignee: Lev Veyde
QA Contact: peyu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-05-25 15:31 UTC by Lev Veyde
Modified: 2021-07-06 07:28 UTC (History)
11 users (show)

Fixed In Version: imgbased-1.2.21
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-07-06 07:28:13 UTC
oVirt Team: Integration
Embargoed:
pm-rhel: ovirt-4.4+
sbonazzo: devel_ack?
peyu: testing_ack+

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
oVirt gerrit 114940 0 master MERGED Fixed the improper handling of SUID and SGID files 2021-05-27 10:56:41 UTC

Description Lev Veyde 2021-05-25 15:31:15 UTC 
Description of problem:
After performing the upgrade to oVirt node 4.4.6 an attempt to login through cockpit will fail with: Wrong user name or password


Version-Release number of selected component (if applicable):
4.4.6.3 - 2021-05-18

How reproducible:
100%

Steps to Reproduce:
1. Install oVirt node 4.4.5
2. Upgrade to oVirt node 4.4.6.3
3. Try to access cockpit with the correct root account password

Actual results:
The system will fail to login, saying: Wrong user name or password

Expected results:
The system should allow login with correct username and password 

Additional info:
The issue was debugged and has to do with the imgbase upgrade code.
The workaround is to execute the following command on system after the reboot (with root privileges):

# chmod u+s /usr/libexec/cockpit-session
Comment 1 Sandro Bonazzola 2021-05-25 15:36:36 UTC 
Depending on how risky the fix is, we may consider shipping an async to oVirt 4.4.6
Comment 3 peyu 2021-05-26 07:45:36 UTC 
I tried and the workaround works.
Comment 4 Lev Veyde 2021-05-26 10:56:26 UTC 
The patch for the issue was sent.

Verified the fix (from /var/log/imgbased.log):

...
2021-05-26 10:45:27,224 [DEBUG] (migrate_etc) The mode of file /tmp/mnt.Yf7qS//usr/libexec/cockpit-session is: 4750
2021-05-26 10:45:27,224 [DEBUG] (migrate_etc) Going to restore the access mode
2021-05-26 10:45:27,225 [DEBUG] (migrate_etc) Chowning '/tmp/mnt.Yf7qS//usr/libexec/cockpit-session' to (-1, 990)
2021-05-26 10:45:27,225 [DEBUG] (migrate_etc) Restoring mode of file /tmp/mnt.Yf7qS//usr/libexec/cockpit-session to: 4750
2021-05-26 10:45:27,256 [DEBUG] (migrate_etc) The mode of directory /tmp/mnt.Yf7qS//usr/share/factory/var/log/chrony is: 755
2021-05-26 10:45:27,256 [DEBUG] (migrate_etc) Chowning '/tmp/mnt.Yf7qS//usr/share/factory/var/log/chrony' to (995, 992)
2021-05-26 10:45:27,256 [DEBUG] (migrate_etc) The mode of directory /tmp/mnt.Yf7qS//usr/share/factory/var/log/ovirt-imageio is: 755
2021-05-26 10:45:27,256 [DEBUG] (migrate_etc) Chowning '/tmp/mnt.Yf7qS//usr/share/factory/var/log/ovirt-imageio' to (990, 986)
2021-05-26 10:45:27,257 [DEBUG] (migrate_etc) The mode of directory /tmp/mnt.Yf7qS//usr/share/factory/var/lib/unbound is: 755
2021-05-26 10:45:27,257 [DEBUG] (migrate_etc) Chowning '/tmp/mnt.Yf7qS//usr/share/factory/var/lib/unbound' to (991, 988)
2021-05-26 10:45:27,257 [DEBUG] (migrate_etc) The mode of directory /tmp/mnt.Yf7qS//usr/share/factory/var/lib/chrony is: 755
2021-05-26 10:45:27,257 [DEBUG] (migrate_etc) Chowning '/tmp/mnt.Yf7qS//usr/share/factory/var/lib/chrony' to (995, 992)
2021-05-26 10:45:27,257 [DEBUG] (migrate_etc) The mode of file /tmp/mnt.Yf7qS//usr/share/factory/var/lib/unbound/root.key is: 644
2021-05-26 10:45:27,258 [DEBUG] (migrate_etc) Chowning '/tmp/mnt.Yf7qS//usr/share/factory/var/lib/unbound/root.key' to (991, 988)
2021-05-26 10:45:27,260 [DEBUG] (migrate_etc) The mode of file /tmp/mnt.Yf7qS//usr/share/factory/etc/chrony.keys is: 640
2021-05-26 10:45:27,260 [DEBUG] (migrate_etc) Chowning '/tmp/mnt.Yf7qS//usr/share/factory/etc/chrony.keys' to (-1, 992)
2021-05-26 10:45:27,310 [DEBUG] (migrate_etc) The mode of file /tmp/mnt.Yf7qS//usr/lib/.build-id/dd/8572ed110434805b89c14e52a608474071d7bf is: 4750
2021-05-26 10:45:27,310 [DEBUG] (migrate_etc) Going to restore the access mode
2021-05-26 10:45:27,311 [DEBUG] (migrate_etc) Chowning '/tmp/mnt.Yf7qS//usr/lib/.build-id/dd/8572ed110434805b89c14e52a608474071d7bf' to (-1, 990)
2021-05-26 10:45:27,311 [DEBUG] (migrate_etc) Restoring mode of file /tmp/mnt.Yf7qS//usr/lib/.build-id/dd/8572ed110434805b89c14e52a608474071d7bf to: 4750
...
Comment 5 RHEL Program Management 2021-05-31 09:51:37 UTC 
Target release should be placed once a package build is known to fix a issue. Since this bug is not modified, the target version has been reset. Please use target milestone to plan a fix for a oVirt release.
Comment 6 peyu 2021-06-01 06:40:24 UTC 
QE verified this bug on "ovirt-node-ng-image-update-4.4.7-0.1.rc1.el8.noarch.rpm".

Test steps:
1. Install oVirt node 4.4.5
2. Setup local repos and point to "ovirt-node-ng-image-update-4.4.7-0.1.rc1.el8.noarch.rpm"
3. Upgrade to oVirt node 4.4.7
4. Try to access cockpit with the correct root account password

Test results:
Login to cockpit successfully.

Will move the bug Status to "VERIFIED".
Comment 7 Sandro Bonazzola 2021-07-06 07:28:13 UTC 
This bugzilla is included in oVirt 4.4.7 release, published on July 6th 2021.

Since the problem described in this bug report should be resolved in oVirt 4.4.7 release, it has been closed with a resolution of CURRENT RELEASE.

If the solution does not work for you, please open a new bug report.
Note You need to log in before you can comment on or make changes to this bug.