Summary: | Can't open /var/log/koha/kohadev/opac-error.log (Permission denied) | ||
---|---|---|---|
Product: | Koha | Reporter: | Katrin Fischer <katrin.fischer> |
Component: | Installation and upgrade (command-line installer) | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | blocker | ||
Priority: | P5 - low | CC: | 1joynelson, dcook, jonathan.druart, kyle, m.de.rooy, martin.renvoize, nick, tomascohen, victor |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28477 | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
20.05.00
|
|
Circulation function: | |||
Bug Depends on: | 25172 | ||
Bug Blocks: | 25529, 25693 | ||
Attachments: |
Bug 25284: chown /var/log/koha log files on koha-create
Bug 25284: chown /var/log/koha log files on koha-create Bug 25284: chown /var/log/koha log files on koha-create |
Description
Katrin Fischer
2020-04-25 23:10:48 UTC
Bug 25172 made a permissions problem raise an error instead of just not working. With this we can now test this situations and fix them properly. So far it has broken 2 main features for me: checkout and saving system preferences. I am continuing my QA work without those patches right now, because I can't otherwise. I am not sure if we should not push these fixes after the release? We fixed it manually in koha-testing-docker by setting the right permissions. You should do the same in kohadevbox so it is back to functional and you can test things. No worries about this, we will solve it before the release, and I will set a pipeline for testing this on normal packages install (i.e. build a package, install it, and check the generated permissions. Probably on monday. (In reply to Tomás Cohen Arazi from comment #3) > We fixed it manually in koha-testing-docker by setting the right > permissions. You should do the same in kohadevbox so it is back to > functional and you can test things. > No worries about this, we will solve it before the release, and I will set a > pipeline for testing this on normal packages install (i.e. build a package, > install it, and check the generated permissions. Probably on monday. So how do I fix the permissions on the kohadevbox? $ koha-plack --stop kohadev $ chown -R kohadev-koha:kohadev-koha /var/log/Koha/kohadev/* (In reply to Tomás Cohen Arazi from comment #5) > $ koha-plack --stop kohadev > $ chown -R kohadev-koha:kohadev-koha /var/log/Koha/kohadev/* $ sudo koha-plack --stop kohadev $ sudo chown -R kohadev-koha:kohadev-koha /var/log/koha/kohadev/* Just a tiny fix in the path and it did the trick, thx! Should we close this? (In reply to Tomás Cohen Arazi from comment #3) > We fixed it manually in koha-testing-docker by setting the right > permissions. You should do the same in kohadevbox so it is back to > functional and you can test things. > No worries about this, we will solve it before the release, and I will set a > pipeline for testing this on normal packages install (i.e. build a package, > install it, and check the generated permissions. Probably on monday. From Tomas comment it sounds like there is still ab it more work needed. (In reply to Katrin Fischer from comment #8) > (In reply to Tomás Cohen Arazi from comment #3) > > We fixed it manually in koha-testing-docker by setting the right > > permissions. You should do the same in kohadevbox so it is back to > > functional and you can test things. > > No worries about this, we will solve it before the release, and I will set a > > pipeline for testing this on normal packages install (i.e. build a package, > > install it, and check the generated permissions. Probably on monday. > > From Tomas comment it sounds like there is still ab it more work needed. I'm building a master package at the moment, to try see if this is specific to our dev tools, or if it poses a real issue on production. Any news from this, Tomasito? Created attachment 105086 [details] [review] Bug 25284: chown /var/log/koha log files on koha-create To prevent Apache to create intranet-error.log and opac-error.log with root permission we chown them after it has been restarted (and so created them) when a new Koha instance is created What happens at log rotation ? (In reply to Marcel de Rooy from comment #12) > What happens at log rotation ? Good question. It is set to copytruncate so permissions should be always kept. I tried by manually forcing rotation and the expected results show up. Had to run $ logrotate -f /etc/logrotate.d/koha-common But removing weekly to force it. Is this plan correct? - spin up a KohaDevBox on master - try to do a checkout and save a system preference - error: Can't open /var/log/koha/kohadev/opac-error.log (Permission denied) - throw the KohaDevBox away - apply patch - spin up a KohaDevBox - try to do a checkout and save a system preference - no error (In reply to Victor Grousset/tuxayo from comment #14) > Is this plan correct? > > - spin up a KohaDevBox on master > - try to do a checkout and save a system preference > - error: Can't open /var/log/koha/kohadev/opac-error.log (Permission denied) > - throw the KohaDevBox away > - apply patch > - spin up a KohaDevBox > - try to do a checkout and save a system preference > - no error 1. Create a new instance: $ koha-create --create-db test => FAIL: opac and intranet logs are owned by root 2. Apply this patch 3. Reset all, so it runs cp_debian_files.pl 4. Repeat 1, with another name => SUCCESS: logs are owned by the right user Without any patch.
Went into my DevBox.
Tried to create an instance.
No issues :o
> vagrant@kohadevbox:~$ sudo su -
> root@kohadevbox:~# koha-create --create-db test
> Koha instance is empty, no staff user created.
> [ ok ] Starting Koha indexing daemon for test:.
My steps to reproduce: $ mkdir stretch ; cd stretch $ vagrant init debian/stretch64 $ vagrant up $ vagrant ssh root@stretch:~# apt update ; apt install wget gnupg root@stretch:~# echo 'deb http://debian.koha-community.org/koha 19.11 main' > /etc/apt/sources.list.d/koha.list root@stretch:~# wget -q -O- https://debian.koha-community.org/koha/gpg.asc | apt-key add - root@stretch:~# apt update root@stretch:~# ls /var/log alternatives.log apache2 apt auth.log btmp daemon.log debug dpkg.log exim4 faillog fontconfig.log installer kern.log lastlog messages mysql syslog user.log wtmp root@stretch:~# apt install koha-common Reading package lists... Done Building dependency tree Reading state information... Done Suggested packages: letsencrypt The following NEW packages will be installed: koha-common 0 upgraded, 1 newly installed, 0 to remove and 72 not upgraded. Need to get 0 B/32.1 MB of archives. After this operation, 468 MB of additional disk space will be used. Preconfiguring packages ... Selecting previously unselected package koha-common. (Reading database ... 58880 files and directories currently installed.) Preparing to unpack .../koha-common_19.11.05-1_all.deb ... Unpacking koha-common (19.11.05-1) ... Processing triggers for systemd (232-25+deb9u8) ... Setting up koha-common (19.11.05-1) ... Processing triggers for man-db (2.7.6.1-2) ... Processing triggers for systemd (232-25+deb9u8) ... root@stretch:~# koha-create --create-db t_e_s_t Koha instance is empty, no staff user created. [ ok ] Starting Koha indexing daemon for t_e_s_t:. root@stretch:~# ls -l /var/log/koha/t_e_s_t/ total 4 -rw-r--r-- 1 t_e_s_t-koha t_e_s_t-koha 0 May 19 21:54 indexer-error.log -rw-r--r-- 1 t_e_s_t-koha t_e_s_t-koha 2380 May 19 21:54 indexer-output.log -rw-r--r-- 1 root root 0 May 19 21:54 intranet-error.log -rw-r--r-- 1 root root 0 May 19 21:54 opac-error.log -rw-r--r-- 1 t_e_s_t-koha t_e_s_t-koha 0 May 19 21:54 zebra-error.log -rw-r--r-- 1 t_e_s_t-koha t_e_s_t-koha 0 May 19 21:54 zebra-output.log root@stretch:~# To test: 1. Built a package with the patch 2. Installed it (I really had it previously created and on the 'stretch' directory so the deb files were in /vagrant inside the box 3. Created a new instance => SUCCESS: The permissiosn are correct I stripped from those steps the install of mysql-server and some issue I had with mpm_itk between retries. Created attachment 105124 [details] [review] Bug 25284: chown /var/log/koha log files on koha-create To prevent Apache to create intranet-error.log and opac-error.log with root permission we chown them after it has been restarted (and so created them) when a new Koha instance is created Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 105137 [details] [review] Bug 25284: chown /var/log/koha log files on koha-create To prevent Apache to create intranet-error.log and opac-error.log with root permission we chown them after it has been restarted (and so created them) when a new Koha instance is created Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Thanks guys.. A little playing later and I'm PQAing this too.. Nice work everyone! Pushed to master for 20.05 missing dependency no backported to 19.11.x There are users on the ML reporting such problems on upgrade. Should we deal with that somewhere else. Like in koha-common.postinst? There is _check_and_fix_perms in koha-plack to fix plack.log and plack-error.log. But that does not seem the right place. (In reply to Jonathan Druart from comment #25) > There is _check_and_fix_perms in koha-plack to fix plack.log and > plack-error.log. > But that does not seem the right place. koha-common.postinst See bug 25693. We've been having this issue again lately in 20.11... I'm going to keep my eye on it. Ahh I talked about this a bit on Bug 16357, but I never followed through. The real fix is to do the following change. FROM: log4perl.appender.INTRANET=Log::Log4perl::Appender::File log4perl.appender.INTRANET.filename=__LOG_DIR__/intranet-error.log log4perl.appender.OPAC=Log::Log4perl::Appender::File log4perl.appender.OPAC.filename=__LOG_DIR__/opac-error.log TO: log4perl.appender.INTRANET=Log::Log4perl::Appender::Screen log4perl.appender.INTRANET.stderr = 1 log4perl.appender.OPAC=Log::Log4perl::Appender::Screen log4perl.appender.OPAC.stderr = 1 Actually I don't think that's right after all. I think it would cause some issues for Plack as I note in Bug 28477... |