Bug 27844

Summary: koha-worker systemd service should run as %i-koha in package install
Product: Koha Reporter: David Cook <dcook>
Component: Architecture, internals, and plumbingAssignee: David Cook <dcook>
Status: CLOSED FIXED QA Contact: Kyle M Hall <kyle>
Severity: normal    
Priority: P5 - low CC: andrewfh, fridolin.somers, jonathan.druart, kyle, victor
Version: master   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25674
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.06
Bug Depends on: 26363    
Bug Blocks:    
Attachments: Bug 27844: Launch koha-worker systemd service as koha linux user
Bug 27844: Launch koha-worker systemd service as koha linux user
Bug 27844: Launch koha-worker systemd service as koha linux user

Description David Cook 2021-03-02 22:26:00 UTC
Frido pointed out that koha-worker will run as root in a package install because we haven't specified a lower privileged Koha-specific user. See https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26363#c32.
Comment 1 David Cook 2021-03-02 23:05:47 UTC
And I just remembered that we can't securely use systemd in a container, and trying to do so for testing purposes is challenging as well.
Comment 2 David Cook 2021-03-02 23:36:29 UTC
Created attachment 117552 [details] [review]
Bug 27844: Launch koha-worker systemd service as koha linux user

This patch adds the User directive to the koha-worker systemd unit file

Test plan:
0a. DO NOT APPLY PATCH YET
0b. Start a Koha testing environment running systemd
1. koha-worker --stop kohadev
2. cp debian/templates/koha-worker@.service /etc/systemd/system/.
3. systemctl start koha-worker@kohadev.service
4. ps -efww | grep "background_jobs_worker"
5. Note koha-worker is running as root
6. APPLY THE PATCH
7. cp debian/templates/koha-worker@.service /etc/systemd/system/.
8. systemctl daemon-reload
9. systemctl restart koha-worker@kohadev.service
10. ps -efww | grep "background_jobs_worker"
11. Note that koha-worker is now running as kohadev-koha
Comment 3 David Cook 2021-03-02 23:39:06 UTC
Here are some instructions on how to create a koha-testing-docker container with Systemd using Docker:

Systemd in container (insecurely):
0. Build an image FROM koha/koha-testing:master
1. Install systemd and systemd-sysv
2. CMD ["/sbin/init"]
3. Update your docker-compose file to use this new systemd image for koha container
4. Update your docker-compose file to use "privileged: true" to the koha container
5. Enter into the koha container and run /kohadevbox/run.sh by hand
6. systemctl daemon-reload
7. service koha-common stop
8. service koha-common start
Comment 4 David Cook 2021-03-03 00:04:23 UTC
Alternative (more secure) systemd inspired by https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non-privileged-container/:

Systemd in container (insecurely):
0. Build an image FROM koha/koha-testing:master
1. Install systemd and systemd-sysv
2. CMD ["/sbin/init"]
3. Update your docker-compose file to use this new systemd image for koha container
4. Update your docker-compose file to have a volume "/sys/fs/cgroup:/sys/fs/cgroup:ro" for the koha container
5. Enter into the koha container and run /kohadevbox/run.sh by hand
6. systemctl daemon-reload
7. service koha-common stop
8. service koha-common start
Comment 5 Jonathan Druart 2021-03-18 10:52:49 UTC
Is this patch ready for testing, David?
Comment 6 David Cook 2021-03-18 22:29:56 UTC
(In reply to Jonathan Druart from comment #5)
> Is this patch ready for testing, David?

I think so. I must've forgotten to mark it as Needs Signoff.
Comment 7 Victor Grousset/tuxayo 2021-05-02 00:54:54 UTC
/kohadevbox/run.sh yields the following error.

Note: Writing koha-zebra.8
Running [sudo rm /usr/share/man/man8/koha-*.8.gz]...
Running [sudo gzip /usr/share/man/man8/koha-*.8]...
See kohadev-db-request.txt for database creation request.
Please forward it to the right person, and then run
/usr/sbin/koha-create --populate-db kohadev
Thanks.
Failed to connect to bus: No such file or directory
[....] Restarting apache2 (via systemctl): apache2.serviceFailed to connect to bus: No such file or directory
 failed!

######
                                                                                                                                                                                                                                          /h/d/d/k/koha-testing-docker ❯❯❯ cat Dockerfile-27844
FROM koha/koha-testing:master
RUN apt-get update \
   && apt-get -y install systemd systemd-sysv
CMD ["/sbin/init"]

######

git diff docker-compose.yml
     koha:
-        image: koha/koha-testing:${KOHA_IMAGE}
+        image: container-bug-27844
         depends_on:
[...]
             - /home/datumoj/dev/koha/koha-testing-docker/persistent-files/bash_history-koha:/var/lib/koha/kohadev/.bash_history
+            - /sys/fs/cgroup:/sys/fs/cgroup:ro
         tmpfs:


#####
build command
docker build -t container-bug-27844 -f Dockerfile-27844 .
Comment 8 David Cook 2021-05-02 23:16:14 UTC
Bizarre. I'm probably not going to look at this again any time soon, so you might want to try a non-containerized Docker environment.
Comment 9 Victor Grousset/tuxayo 2021-05-03 15:59:56 UTC
> you might want to try a non-containerized Docker environment.

You mean a non-koha-testing-docker env? Still using docker and with manual Koha install.

And what about a KohaDevBox?
Comment 10 David Cook 2021-05-04 00:48:47 UTC
(In reply to Victor Grousset/tuxayo from comment #9)
> > you might want to try a non-containerized Docker environment.
> 
> You mean a non-koha-testing-docker env? Still using docker and with manual
> Koha install.
 
Haha I meant a non-containerized Dev environment. I used the wrong D word. 

> And what about a KohaDevBox?

Yep that should work.
Comment 11 Victor Grousset/tuxayo 2021-05-10 23:12:12 UTC
Created attachment 120817 [details] [review]
Bug 27844: Launch koha-worker systemd service as koha linux user

This patch adds the User directive to the koha-worker systemd unit file

Test plan:
0a. DO NOT APPLY PATCH YET
0b. Start a Koha testing environment running systemd
1. koha-worker --stop kohadev
2. cp debian/templates/koha-worker@.service /etc/systemd/system/.
3. systemctl start koha-worker@kohadev.service
4. ps -efww | grep "background_jobs_worker"
5. Note koha-worker is running as root
6. APPLY THE PATCH
7. cp debian/templates/koha-worker@.service /etc/systemd/system/.
8. systemctl daemon-reload
9. systemctl restart koha-worker@kohadev.service
10. ps -efww | grep "background_jobs_worker"
11. Note that koha-worker is now running as kohadev-koha

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 12 Victor Grousset/tuxayo 2021-05-10 23:18:11 UTC
Lol so easy to test with a devbox :D It works!

A bit out of topic: Good thing it's still there. If the question of redoing it as wrapper of koha-testing-docker come up, it needs to be kept in mind that such tests won't be as easy due to loosing systemd in the process.
Likely not that often needed to be a great weight in the balance. I could have used vagrant for a Debian VM and installed Koha there. Hum, sharing the code with the host might be difficult. And maybe I would have needed this gitify thing. Hum, might be harder than expected.
</offtopic>
Comment 13 Kyle M Hall 2021-05-13 18:00:53 UTC
Created attachment 120944 [details] [review]
Bug 27844: Launch koha-worker systemd service as koha linux user

This patch adds the User directive to the koha-worker systemd unit file

Test plan:
0a. DO NOT APPLY PATCH YET
0b. Start a Koha testing environment running systemd
1. koha-worker --stop kohadev
2. cp debian/templates/koha-worker@.service /etc/systemd/system/.
3. systemctl start koha-worker@kohadev.service
4. ps -efww | grep "background_jobs_worker"
5. Note koha-worker is running as root
6. APPLY THE PATCH
7. cp debian/templates/koha-worker@.service /etc/systemd/system/.
8. systemctl daemon-reload
9. systemctl restart koha-worker@kohadev.service
10. ps -efww | grep "background_jobs_worker"
11. Note that koha-worker is now running as kohadev-koha

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 14 Jonathan Druart 2021-05-17 14:19:44 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 15 Fridolin Somers 2021-05-18 10:16:53 UTC
Pushed to 20.11.x for 20.11.06
Comment 16 Andrew Fuerste-Henry 2021-05-25 13:39:38 UTC
Missing dependency, not backported to 20.05.x