Bug 516767

This has been confirmed as being spacewalk-repo-sync's fault by other users. I dived a bit into that python stuff and made the following patch, which works for me. Be aware, that this was made by a person who's missing the understanding of the whole backend. My change might influence other scripts in a bad way.

--- /usr/share/rhn/server/rhnPackageUpload.py.orig      2009-08-15 19:57:34.000000000 +0200
+++ /usr/share/rhn/server/rhnPackageUpload.py   2009-08-15 20:11:57.000000000 +0200
@@ -147,6 +147,8 @@
     except importLib.FileConflictError:
         raise rhnFault(50, "File already exists")

+    os.system("chown apache:apache %s/%s" % (CFG.MOUNT_POINT, relative_path))
+
     pkg = mpmSource.create_package(header, size=payload_size, md5sum=md5sum,
         relpath=relative_path, org_id=org_id, header_start=header_start,
         header_end=header_end, channels=channels)

Okay I have reproduced this on 0.6 and 0.7 so here's some steps:

1) Spacewalk install that is empty of any packages so that /var/satellite/redhat/{$org_number}/ is empty. Verify that that directory is owned by apache:apache as it should be by default.
2) Create a channel and rhnpush something to it.
3) Verify that the directory created for this within /var/satellite/redhat/{$org_number}/ is owned by apache:apache as it should be.
2) Create a channel and sync it with an upstream yum repository with the spacewalk-repo-sync python command/script.
3) Check the ownership of the folders within /var/satellite/redhat/${org_number}/ directory. They will be shown as root:root apart from the directory created earlier by the rhnpush command which will be apache:apache properly.
4) rhnpush something that would end up in one of the directories that had been automatically created by spacewalk-repo-sync
5) the rhnpush will fail with permission denied to /var/satellite/redhat/{$org_number}/{something}/
6) chown apache:apache the directory mentioned in the error and try to rhnpush again - this time it will be successful.

Suggestion for fix:

Have a configurable value in /etc/rhn/rhn.conf or /etc/sysconfig/up2date defaulting to apache for the owner/group the spacewalk server is running the web interface as. Have spacewalk-repo-sync drop credentials when run or otherwise fork itself to a process run as the user configured for the web interface.

I don't believe there is anything that spacewalk-repo-sync specifically needs to be root for during the sync? If not then dropping credentials would be fine.... If it does then either chown each package and directory after import or fork the bit that creates the folders and file to the user would work...

Rather than chowning the directory in rhnPackageUpload.py the actual direcory creation and file write is carried out by server/importlib/importLib.py 

It would be better to have that read in the configuration for what user the directory path and files should be and write out as that user.

Specifically the copy_package method defined appears to be responsible for the final actual directory creation and file write so an os.chown would probably be better there...

*** Bug 527990 has been marked as a duplicate of this bug. ***

Fixed in spacewalk.git:

commit fd48c14fa88f53c59ea117e235f93c7010fc79a3
    516767 - create files with default repository owner/group/permissions
             rather than root.root

Fixed package:
spacewalk-backend-0.8.5-1

Spacewalk 0.8 has been released

Also reported:

Bug 567649 - rhnpush creates apache:apache files/dirs in /var/satellite/redhat/1/