Hide Forgot
I stumbled on this by accident by running a consumer create without sudo: jdob@atlantis ~/.pulp -> pulp-client -u admin -p admin consumer create --id localhost-consumer warning: this client is not registered; please register to continue Traceback (most recent call last): File "/usr/bin/pulp-client", line 7, in <module> execfile(__file__) File "/home/jdob/code/pulp/bin/pulp-client", line 63, in <module> client.main() File "/home/jdob/code/pulp/src/pulp/client/cli/base.py", line 117, in main command.main(args[1:]) File "/home/jdob/code/pulp/src/pulp/client/core/base.py", line 116, in main action.main(args[1:]) File "/home/jdob/code/pulp/src/pulp/client/core/base.py", line 204, in main self.run() File "/home/jdob/code/pulp/src/pulp/client/core/consumer.py", line 179, in run bundle.write(crt) File "/home/jdob/code/pulp/src/pulp/common/bundle.py", line 149, in write self.mkdir() File "/home/jdob/code/pulp/src/pulp/common/bundle.py", line 172, in mkdir os.makedirs(path) File "/usr/lib64/python2.7/os.py", line 157, in makedirs mkdir(name, mode) OSError: [Errno 13] Permission denied: '/etc/pki/consumer' jdob@atlantis ~/.pulp -> sudo pulp-client -u admin -p admin consumer create --id localhost-consumer warning: this client is not registered; please register to continue error: operation failed: Consumer with id: localhost-consumer already exists Since we know consumer create is going to write to that directory, before even sending the request to the server we should make sure the user has write privileges. Otherwise, they'll need to use the admin CLI to delete the consumer before repeating the command with root privileges.
We need to add checking
At very least, we need to make changes so that use can't run pulp-client as non-root.
I just ran into the exact situation Jay describes and it took me a while to figure out what I had done wrong (i.e. run pulp-client as a normal user rather than via sudo). Completely banning running pulp-client as non-root seems overly restrictive though. Other commands (such as "pulp-client repo list") work fine as a non-root user.
Although "consumer bind" does suffer a similar fate to "consumer create"...
Added checks for write permissions before we register/unregister/bind/unbind a consumer. The checks happen before we send the request to the pulp server, so if we have to fail the operation, the pulp server does not get out of sync with what is on the consumer. commit 76b394dbd5276af04c857e4ab4300235ccd87ab7 QA: If you attempt one of these operations without the correct write permissions needed you will see: error: Write permission is required for /etc/pki/consumer/pulp to perform this operation. The /etc/pki/consumer/pulp path will be /etc/yum.repos.d if the operation is a bind or unbind.
build: 0.256
verified [root@el6-client ~]# ls -l /etc/pki/pulp/ total 4 dr-xr-xr-x. 2 root root 4096 Jan 6 16:10 consumer [pthomas@pthomas-lt ~]$ ssh guest1.79.217 reverse mapping checking getaddrinfo for unused [10.16.79.217] failed - POSSIBLE BREAK-IN ATTEMPT! guest1.79.217's password: [guest1@el6-client ~]$ pulp-consumer -u admin -p admin consumer unregister error: Write permission is required for /etc/pki/pulp/consumer/cert.pem to perform this operation. [guest1@el6-client ~]$ pulp-consumer -u admin -p admin consumer bind --repoid=f15 error: Write permission is required for /etc/yum.repos.d to perform this operation. [guest1@el6-client ~]$ pulp-consumer -u admin -p admin consumer unbind --repoid=f15 error: Write permission is required for /etc/yum.repos.d to perform this operation. [guest1@el6-client ~]$ [guest1@el6-client ~]$ pulp-consumer -u admin -p admin consumer register --id=el6-client warning: this client is not known to the pulp server; run 'pulp-consumer consumer register' to register it error: Write permission is required for /etc/pki/pulp/consumer to perform this operation. [guest1@el6-client ~]$ ls -l /etc/pki/pulp/ total 4 drwxr-xr-x. 2 guest1 root 4096 Jan 6 16:31 consumer [guest1@el6-client ~]$ [guest1@el6-client ~]$ pulp-consumer -u admin -p admin consumer register --id=el6-client warning: this client is not known to the pulp server; run 'pulp-consumer consumer register' to register it Successfully registered consumer [ el6-client ]
Pulp v1.0 is released Closed Current Release.
Pulp v1.0 is released.