Bug 704653 - Misleading/wrong error message on cumin service start by unprivileged user.
Summary: Misleading/wrong error message on cumin service start by unprivileged user.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise MRG
Classification: Red Hat
Component: cumin
Version: 2.0
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: 2.0.1
: ---
Assignee: Trevor McKay
QA Contact: Jan Sarenik
URL:
Whiteboard:
Depends On:
Blocks: 723887
TreeView+ depends on / blocked
 
Reported: 2011-05-13 20:55 UTC by Trevor McKay
Modified: 2011-09-07 18:17 UTC (History)
3 users (show)

Fixed In Version: cumin-0.1.4840-1
Doc Type: Bug Fix
Doc Text:
The cumin service init script must be run as the root user. However, the script lacked a check to ensure that it was run by the root user, with the result that running the script as an unprivileged user resulted in misleading error messages. With this update, the script fails immediately (and displays "[FAILED]") when it is run as an unprivileged user.
Clone Of:
Environment:
Last Closed: 2011-09-07 18:17:29 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1249 0 normal SHIPPED_LIVE Moderate: Red Hat Enterprise MRG Grid 2.0 security, bug fix and enhancement update 2011-09-07 16:40:45 UTC

Description Trevor McKay 2011-05-13 20:55:22 UTC
Description of problem:

Running "service cumin start" as an unprivileged user gives misleading error messages.  It complains that postgresql is not running, even if it is.  Find out exactly what is happening here, maybe find a better message.

4:38:26pm> eeyore:cumin/MRG-RHEL-6/cumin-0.1.4746 $ service cumin restart
Cumin's database server is not running
Run 'cumin-database start' as root
04:38:30pm> eeyore:cumin/MRG-RHEL-6/cumin-0.1.4746 $ sudo service cumin restart
Stopping cumin:                                            [  OK  ]
Starting cumin:

Comment 1 Trevor McKay 2011-05-23 17:14:01 UTC
After poking around, this is related to a general issue in RHEL 5, the SysVinit component.  Specificaly, the use of the "-c" option to pidof causes /sbin/service postgresql status to say that it's not running.

In the BZ below, the resolution seems to be to change init.d/functions so that it warns when privileges are required for a particular operation.  If that fix works, then in the particular cumin case the user should be warned that insufficient privilege exists to start cumin.

https://bugzilla.redhat.com/show_bug.cgi?id=684881

Comment 3 Trevor McKay 2011-05-25 14:34:14 UTC
Grabbed latest SysVinit package (SysVinit-2.86-17.el5), pidof -c has been fixed.

So, that particular issue will be repaired, however cumin checks for root user in cumin-database script used during startup, so the error messages are still misleading.  Fix coming....

Comment 4 Trevor McKay 2011-05-25 14:54:13 UTC
Fixed in revision 4786.

Comment 5 Trevor McKay 2011-05-25 15:00:25 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:
  Scripts used during Cumin service start up must be run as the root user.  However, the root user check is missing in the Cumin SysVinit script.

Consequence:
  Attempting to start the cumin service as a non-root user gives misleading error messages, when the real problem is that the user is not root.

Fix:
  Add a root user check to the SysVinit script.  Mark the service start [FAILED] with an explanation if the user is not root.

Result:
  Non-root users will now be given accurate information on why the service start failed.

Comment 6 Trevor McKay 2011-05-25 15:22:43 UTC
For testing:

  Additional checks added to start case (includes start, restart, condrestart) and stop (if cumin was running).  These commands as a non-root user should FAIL with the the message "Must be root".

  Status should work as an unprivileged user as long as SysVinit-2.86-17.el5 or later is installed.

Comment 7 Jan Sarenik 2011-06-21 14:47:19 UTC
cumin-0.1.4840-1.el6.noarch

$ service cumin start
Starting cumin:                                            [FAILED]
Must be run as root

Comment 8 Douglas Silas 2011-08-08 14:31:02 UTC
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1,11 +1 @@
-Cause:
+The cumin service init script must be run as the root user. However, the script lacked a check to ensure that it was run by the root user, with the result that running the script as an unprivileged user resulted in misleading error messages. With this update, the script fails immediately (and displays "[FAILED]") when it is run as an unprivileged user.-  Scripts used during Cumin service start up must be run as the root user.  However, the root user check is missing in the Cumin SysVinit script.
-
-Consequence:
-  Attempting to start the cumin service as a non-root user gives misleading error messages, when the real problem is that the user is not root.
-
-Fix:
-  Add a root user check to the SysVinit script.  Mark the service start [FAILED] with an explanation if the user is not root.
-
-Result:
-  Non-root users will now be given accurate information on why the service start failed.


Note You need to log in before you can comment on or make changes to this bug.