SystemVM template upgrade fails on security hardened management servers #10029
Milestone
Comments
|
@rajujith @Pearl1594 , should this be documented as an upgrade requirement (set the umask to 0022 at most), or can we search with sudo as well? |
|
I think it would be nice if we could try and see how we can adapt the template registration script to run on a hardened system. And if that is not straightforward, we can document a workaround that the template needs to be pre-registered before upgrade to prevent the script from running. |
sureshanaparti
moved this from Todo
to Dev In Progress
in Apache CloudStack BugFest - Issues
14 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
ISSUE TYPE
COMPONENT NAME
CLOUDSTACK VERSION
CONFIGURATION
Upgrade from 4.18.2.3 to 4.19.1.3
OS / ENVIRONMENT
EL
SUMMARY
On management servers with security hardening implemented for example umask set to 0027 the systemVM template upgrade fails. Script 'setup-sysvm-tmplt' creates directory with 'sudo' but attempts to find the template without sudo. This fails in the secured operating systems.
[cloud@mgmt1 ~]$ umask 0027
[cloud@mgmt1 ~]$ sudo mkdir -p /tmp/tmp10896605671384965986/template/tmpl/1/8
[cloud@mgmt1 ~]$ find /tmp/tmp10896605671384965986/template/tmpl/1/8 -name '*.ova'
find: ‘/tmp/tmp10896605671384965986/template/tmpl/1/8’: Permission denied
STEPS TO REPRODUCE
EXPECTED RESULTS
ACTUAL RESULTS
The text was updated successfully, but these errors were encountered: