Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2117221

Summary:	horizon : /var/tmp/ permissions incorrect on controllers
Product:	Red Hat OpenStack	Reporter:	François Rigault <frigo>
Component:	openstack-tripleo-heat-templates	Assignee:	Cédric Jeanneret <cjeanner>
Status:	CLOSED ERRATA	QA Contact:	Joe H. Rahme <jhakimra>
Severity:	low	Docs Contact:
Priority:	low
Version:	16.2 (Train)	CC:	cjeanner, ebarrera, mburns
Target Milestone:	z4	Keywords:	Triaged
Target Release:	16.2 (Train on RHEL 8.4)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-tripleo-heat-templates-11.6.1-2.20221010235131.e0d438c.el8ost	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-07 19:24:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description François Rigault 2022-08-10 10:56:37 UTC

Description of problem:
following deployment and update of the stack, /var/tmp permissions are set to d-wxrwS--t. (which is decimal 1777, not octal 01777)


Version-Release number of selected component (if applicable):
RHOSP 16.2.3
openstack-tripleo-heat-templates-11.6.1-2.20220409014852.el8ost.noarch

How reproducible:
keep your RHOSP 16.2 updated

Steps to Reproduce:
1. deploy a stack with RHOSP 16.2.2
2. overcloud update to 16.2.3
3. stat /var/tmp on a controller

Actual results:
Access: (3361/d-wxrwS--t)

Expected results:
1777 instead

Additional info:
noticed in https://review.opendev.org/c/openstack/tripleo-heat-templates/+/788153

deploying with

--- openstack-tripleo-heat-templates/deployment/horizon/horizon-container-puppet.yaml       2022-08-10 10:55:41.553687400 +0000
+++ openstack-tripleo-heat-templates/deployment/horizon/horizon-container-puppet.yaml   2022-08-10 10:55:46.509149754 +0000
@@ -382,7 +382,7 @@
                 path: /var/tmp
                 state: directory
                 setype: tmp_t
-                mode: 1777
+                mode: 01777
       update_tasks:
         - name: Anchor for upgrade and update tasks
           when: step|int == 0

seems to fix it.

Comment 1 Cédric Jeanneret 2022-08-10 13:55:03 UTC

Hello there,

Dang... nice catch - "chmod" is doing the right thing, I didn't see the difference while calling via ansible....

A master patch is issued, it will take some time to get it in and then backported down to 16.2 (master -> wallaby -> [17.0] -> train -> [16.2]).

Since there wasn't any priority/severity, I set them both to "medium", please feel free to correct them if you need that patch asap. I'll try to make it for 16.2.4.

Cheers,

C.

Comment 3 François Rigault 2022-08-10 20:41:29 UTC

this did not break anything on my side (.. so far?) so it's not urgent.

also https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html#parameter-mode

mentions the "u+rwx" syntax, which could be less error prone.

In any case thanks for your work!

Comment 12 errata-xmlrpc 2022-12-07 19:24:04 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Release of components for Red Hat OpenStack Platform 16.2.4), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8794