Bug 28364

Summary: koha-z3950-responder breaks because of log4perl.conf permissions
Product: Koha Reporter: Tomás Cohen Arazi <tomascohen>
Component: PackagingAssignee: Tomás Cohen Arazi <tomascohen>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: dcook, ere.maijala, fridolin.somers, jonathan.druart, martin.renvoize, mtj, nick, victor, wainuiwitikapark
Version: master   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31613
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.07,20.05.13,19.11.19
Bug Depends on: 13937    
Bug Blocks: 31612    
Attachments: Bug 28364: Make log4perl.conf belong to the instance user
Bug 28364: Make log4perl.conf belong to the instance user
Bug 28364: Make log4perl.conf belong to the instance user

Description Tomás Cohen Arazi 2021-05-17 13:19:14 UTC
To reproduce:

1. Create a Koha instance:
   $ koha-create --create-db test
2. Initiate all the things
3. Enable and start the z3950 responder
   $ koha-z3950-responder --enable test
   $ koha-z3950-responder --start test
4. Try doing some search:
   $ yaz-client localhost:2100
=> FAIL: you get:
Connecting...OK.
Sent initrequest.
Target closed connection
Z> quit
See you later, alligator.
=> FAIL: No warning or anything on the logs
5. Stop the daemon
   $ koha-z3950-responder --stop test
6. Run it manually:
   $ PERL5LIB=/usr/share/koha/lib KOHA_CONF=/etc/koha/sites/test/koha-conf.xml /usr/bin/perl /usr/share/koha/bin/z3950_responder.pl -c /etc/koha/sites/test/z3950 -u test-koha -p /var/run/koha/test/z3950-responder.pid -d test-koha-z3950
7. Repeat the 4, on a separate terminal (no daemon mode this time)
=> FAIL: You get:
Cannot open /etc/koha/sites/test/log4perl.conf (Permission denied) at /usr/share/perl5/Log/Log4perl/Config/BaseConfigurator.pm line 51.
Comment 1 Tomás Cohen Arazi 2021-05-17 15:21:10 UTC
Created attachment 121056 [details] [review]
Bug 28364: Make log4perl.conf belong to the instance user

This patch makes koha-create generate the log4perl.conf file for the
instance, belonging to the instance user. This is done in order to have
the z3950 responder work.

My original idea was to make the responder accept a '-g' parameter but
that is not supported by Net::Z3950::Responder. Also, as the library
insists on handling the PID file on its own, it wont' work to handle the
responsability to start-stop-daemon. The only solution I found was
making the fiel be owned by the instance user.

1. Create a Koha instance:
   $ koha-create --create-db test
2. Initiate all the things
3. Enable and start the z3950 responder
   $ koha-z3950-responder --enable test
   $ koha-z3950-responder --start test
4. Try doing some search:
   $ yaz-client localhost:2100
=> FAIL: you get:
Connecting...OK.
Sent initrequest.
Target closed connection
Z> quit
See you later, alligator.
=> FAIL: No warning or anything on the logs
5. Stop the daemon
   $ koha-z3950-responder --stop test
6. Run it manually:
   $ PERL5LIB=/usr/share/koha/lib KOHA_CONF=/etc/koha/sites/test/koha-conf.xml \
              /usr/bin/perl /usr/share/koha/bin/z3950_responder.pl \
              -c /etc/koha/sites/test/z3950 -u test-koha \
              -p /var/run/koha/test/z3950-responder.pid -d test-koha-z3950
7. Repeat the 4, on a separate terminal (no daemon mode this time)
=> FAIL: You get:
Cannot open /etc/koha/sites/test/log4perl.conf (Permission denied) at /usr/share/perl5/Log/Log4perl/Config/BaseConfigurator.pm line 51.
8. Change the file owner:
   $ chown test-koha /etc/koha/sites/test/log4perl.conf
9. Repeat 6, and 4
=> SUCCESS: It doesn't break anymore!
10. Apply this patch
11. Create a new instance, with the patched koha-create:
    $ debian/scripts/koha-create --created-db test1
12: Check the generated files permissions:
    $ ls -l /etc/koha/sites/test2
=> SUCCESS: You get:
-rw-r----- 1 root       test2-koha 19720 May 17 13:26 koha-conf.xml
-rw-r----- 1 test2-koha test2-koha  2825 May 17 13:26 log4perl.conf
-rw-r----- 1 root       test2-koha  2014 May 17 13:26 zebra-authorities-dom.cfg
-rw-r----- 1 root       test2-koha  2279 May 17 13:26 zebra-biblios-dom.cfg
-rw-r----- 1 root       test2-koha    26 May 17 13:26 zebra.passwd

13. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 2 Ere Maijala 2021-05-18 07:15:03 UTC
Created attachment 121081 [details] [review]
Bug 28364: Make log4perl.conf belong to the instance user

This patch makes koha-create generate the log4perl.conf file for the
instance, belonging to the instance user. This is done in order to have
the z3950 responder work.

My original idea was to make the responder accept a '-g' parameter but
that is not supported by Net::Z3950::Responder. Also, as the library
insists on handling the PID file on its own, it wont' work to handle the
responsability to start-stop-daemon. The only solution I found was
making the fiel be owned by the instance user.

1. Create a Koha instance:
   $ koha-create --create-db test
2. Initiate all the things
3. Enable and start the z3950 responder
   $ koha-z3950-responder --enable test
   $ koha-z3950-responder --start test
4. Try doing some search:
   $ yaz-client localhost:2100
=> FAIL: you get:
Connecting...OK.
Sent initrequest.
Target closed connection
Z> quit
See you later, alligator.
=> FAIL: No warning or anything on the logs
5. Stop the daemon
   $ koha-z3950-responder --stop test
6. Run it manually:
   $ PERL5LIB=/usr/share/koha/lib KOHA_CONF=/etc/koha/sites/test/koha-conf.xml \
              /usr/bin/perl /usr/share/koha/bin/z3950_responder.pl \
              -c /etc/koha/sites/test/z3950 -u test-koha \
              -p /var/run/koha/test/z3950-responder.pid -d test-koha-z3950
7. Repeat the 4, on a separate terminal (no daemon mode this time)
=> FAIL: You get:
Cannot open /etc/koha/sites/test/log4perl.conf (Permission denied) at /usr/share/perl5/Log/Log4perl/Config/BaseConfigurator.pm line 51.
8. Change the file owner:
   $ chown test-koha /etc/koha/sites/test/log4perl.conf
9. Repeat 6, and 4
=> SUCCESS: It doesn't break anymore!
10. Apply this patch
11. Create a new instance, with the patched koha-create:
    $ debian/scripts/koha-create --create-db test1
12: Check the generated files permissions:
    $ ls -l /etc/koha/sites/test2
=> SUCCESS: You get:
-rw-r----- 1 root       test2-koha 19720 May 17 13:26 koha-conf.xml
-rw-r----- 1 test2-koha test2-koha  2825 May 17 13:26 log4perl.conf
-rw-r----- 1 root       test2-koha  2014 May 17 13:26 zebra-authorities-dom.cfg
-rw-r----- 1 root       test2-koha  2279 May 17 13:26 zebra-biblios-dom.cfg
-rw-r----- 1 root       test2-koha    26 May 17 13:26 zebra.passwd

13. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Comment 3 Martin Renvoize 2021-05-27 08:52:41 UTC
Created attachment 121444 [details] [review]
Bug 28364: Make log4perl.conf belong to the instance user

This patch makes koha-create generate the log4perl.conf file for the
instance, belonging to the instance user. This is done in order to have
the z3950 responder work.

My original idea was to make the responder accept a '-g' parameter but
that is not supported by Net::Z3950::Responder. Also, as the library
insists on handling the PID file on its own, it wont' work to handle the
responsability to start-stop-daemon. The only solution I found was
making the fiel be owned by the instance user.

1. Create a Koha instance:
   $ koha-create --create-db test
2. Initiate all the things
3. Enable and start the z3950 responder
   $ koha-z3950-responder --enable test
   $ koha-z3950-responder --start test
4. Try doing some search:
   $ yaz-client localhost:2100
=> FAIL: you get:
Connecting...OK.
Sent initrequest.
Target closed connection
Z> quit
See you later, alligator.
=> FAIL: No warning or anything on the logs
5. Stop the daemon
   $ koha-z3950-responder --stop test
6. Run it manually:
   $ PERL5LIB=/usr/share/koha/lib KOHA_CONF=/etc/koha/sites/test/koha-conf.xml \
              /usr/bin/perl /usr/share/koha/bin/z3950_responder.pl \
              -c /etc/koha/sites/test/z3950 -u test-koha \
              -p /var/run/koha/test/z3950-responder.pid -d test-koha-z3950
7. Repeat the 4, on a separate terminal (no daemon mode this time)
=> FAIL: You get:
Cannot open /etc/koha/sites/test/log4perl.conf (Permission denied) at /usr/share/perl5/Log/Log4perl/Config/BaseConfigurator.pm line 51.
8. Change the file owner:
   $ chown test-koha /etc/koha/sites/test/log4perl.conf
9. Repeat 6, and 4
=> SUCCESS: It doesn't break anymore!
10. Apply this patch
11. Create a new instance, with the patched koha-create:
    $ debian/scripts/koha-create --create-db test1
12: Check the generated files permissions:
    $ ls -l /etc/koha/sites/test2
=> SUCCESS: You get:
-rw-r----- 1 root       test2-koha 19720 May 17 13:26 koha-conf.xml
-rw-r----- 1 test2-koha test2-koha  2825 May 17 13:26 log4perl.conf
-rw-r----- 1 root       test2-koha  2014 May 17 13:26 zebra-authorities-dom.cfg
-rw-r----- 1 root       test2-koha  2279 May 17 13:26 zebra-biblios-dom.cfg
-rw-r----- 1 root       test2-koha    26 May 17 13:26 zebra.passwd

13. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2021-05-27 08:53:11 UTC
All works as expected now, thanks.

Passing QA
Comment 5 Jonathan Druart 2021-05-27 15:13:48 UTC
This has been hidden because of a chown in misc4dev, maybe we should revert it.

https://gitlab.com/koha-community/koha-misc4dev/-/issues/43
Comment 6 Jonathan Druart 2021-05-27 15:28:18 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 7 Fridolin Somers 2021-05-31 14:44:39 UTC
Pushed to 20.11.x for 20.11.07
Comment 8 Victor Grousset/tuxayo 2021-06-08 23:27:04 UTC
Backported: Pushed to 20.05.x branch for 20.05.13
Comment 9 wainuiwitikapark 2021-06-15 23:07:03 UTC
Does this need to backported to 19.11.x?
Comment 10 wainuiwitikapark 2021-06-17 01:57:04 UTC
Backported to 19.11.x for 19.11.19
Comment 11 David Cook 2022-09-23 02:26:05 UTC
This was driving me absolutely crazy this morning.

Note that this still affects any upgraded Koha. I was trying to use koha-z3950-responder for a current Koha that has been upgraded many times, and yeah... very very frustrating.
Comment 12 Victor Grousset/tuxayo 2022-09-23 03:06:58 UTC
So what to run to manually fix existing instances?
Comment 13 David Cook 2022-09-23 03:42:02 UTC
(In reply to Victor Grousset/tuxayo from comment #12)
> So what to run to manually fix existing instances?

Well manually you can just change the permission using chown based on which Koha user should own it. 

--

Automatically... I've opened Bug 31612 for that one, although I probably won't provide a patch...

I'd say some kind of audit script that checks the permissions of files and then updates them based on their location.

For example, if it's in /etc/koha/sites/kohadev/* then it updates owner to kohadev-koha. 

Lots of different ways to do it which means folk might disagree on how to do it...