Bug 28364 - koha-z3950-responder breaks because of log4perl.conf permissions
Summary: koha-z3950-responder breaks because of log4perl.conf permissions
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Packaging (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Tomás Cohen Arazi
QA Contact: Testopia
URL:
Keywords:
Depends on: 13937
Blocks: 31612
  Show dependency treegraph
 
Reported: 2021-05-17 13:19 UTC by Tomás Cohen Arazi
Modified: 2022-09-23 03:42 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.07,20.05.13,19.11.19


Attachments
Bug 28364: Make log4perl.conf belong to the instance user (3.08 KB, patch)
2021-05-17 15:21 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 28364: Make log4perl.conf belong to the instance user (3.12 KB, patch)
2021-05-18 07:15 UTC, Ere Maijala
Details | Diff | Splinter Review
Bug 28364: Make log4perl.conf belong to the instance user (3.19 KB, patch)
2021-05-27 08:52 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tomás Cohen Arazi 2021-05-17 13:19:14 UTC
To reproduce:

1. Create a Koha instance:
   $ koha-create --create-db test
2. Initiate all the things
3. Enable and start the z3950 responder
   $ koha-z3950-responder --enable test
   $ koha-z3950-responder --start test
4. Try doing some search:
   $ yaz-client localhost:2100
=> FAIL: you get:
Connecting...OK.
Sent initrequest.
Target closed connection
Z> quit
See you later, alligator.
=> FAIL: No warning or anything on the logs
5. Stop the daemon
   $ koha-z3950-responder --stop test
6. Run it manually:
   $ PERL5LIB=/usr/share/koha/lib KOHA_CONF=/etc/koha/sites/test/koha-conf.xml /usr/bin/perl /usr/share/koha/bin/z3950_responder.pl -c /etc/koha/sites/test/z3950 -u test-koha -p /var/run/koha/test/z3950-responder.pid -d test-koha-z3950
7. Repeat the 4, on a separate terminal (no daemon mode this time)
=> FAIL: You get:
Cannot open /etc/koha/sites/test/log4perl.conf (Permission denied) at /usr/share/perl5/Log/Log4perl/Config/BaseConfigurator.pm line 51.
Comment 1 Tomás Cohen Arazi 2021-05-17 15:21:10 UTC
Created attachment 121056 [details] [review]
Bug 28364: Make log4perl.conf belong to the instance user

This patch makes koha-create generate the log4perl.conf file for the
instance, belonging to the instance user. This is done in order to have
the z3950 responder work.

My original idea was to make the responder accept a '-g' parameter but
that is not supported by Net::Z3950::Responder. Also, as the library
insists on handling the PID file on its own, it wont' work to handle the
responsability to start-stop-daemon. The only solution I found was
making the fiel be owned by the instance user.

1. Create a Koha instance:
   $ koha-create --create-db test
2. Initiate all the things
3. Enable and start the z3950 responder
   $ koha-z3950-responder --enable test
   $ koha-z3950-responder --start test
4. Try doing some search:
   $ yaz-client localhost:2100
=> FAIL: you get:
Connecting...OK.
Sent initrequest.
Target closed connection
Z> quit
See you later, alligator.
=> FAIL: No warning or anything on the logs
5. Stop the daemon
   $ koha-z3950-responder --stop test
6. Run it manually:
   $ PERL5LIB=/usr/share/koha/lib KOHA_CONF=/etc/koha/sites/test/koha-conf.xml \
              /usr/bin/perl /usr/share/koha/bin/z3950_responder.pl \
              -c /etc/koha/sites/test/z3950 -u test-koha \
              -p /var/run/koha/test/z3950-responder.pid -d test-koha-z3950
7. Repeat the 4, on a separate terminal (no daemon mode this time)
=> FAIL: You get:
Cannot open /etc/koha/sites/test/log4perl.conf (Permission denied) at /usr/share/perl5/Log/Log4perl/Config/BaseConfigurator.pm line 51.
8. Change the file owner:
   $ chown test-koha /etc/koha/sites/test/log4perl.conf
9. Repeat 6, and 4
=> SUCCESS: It doesn't break anymore!
10. Apply this patch
11. Create a new instance, with the patched koha-create:
    $ debian/scripts/koha-create --created-db test1
12: Check the generated files permissions:
    $ ls -l /etc/koha/sites/test2
=> SUCCESS: You get:
-rw-r----- 1 root       test2-koha 19720 May 17 13:26 koha-conf.xml
-rw-r----- 1 test2-koha test2-koha  2825 May 17 13:26 log4perl.conf
-rw-r----- 1 root       test2-koha  2014 May 17 13:26 zebra-authorities-dom.cfg
-rw-r----- 1 root       test2-koha  2279 May 17 13:26 zebra-biblios-dom.cfg
-rw-r----- 1 root       test2-koha    26 May 17 13:26 zebra.passwd

13. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 2 Ere Maijala 2021-05-18 07:15:03 UTC
Created attachment 121081 [details] [review]
Bug 28364: Make log4perl.conf belong to the instance user

This patch makes koha-create generate the log4perl.conf file for the
instance, belonging to the instance user. This is done in order to have
the z3950 responder work.

My original idea was to make the responder accept a '-g' parameter but
that is not supported by Net::Z3950::Responder. Also, as the library
insists on handling the PID file on its own, it wont' work to handle the
responsability to start-stop-daemon. The only solution I found was
making the fiel be owned by the instance user.

1. Create a Koha instance:
   $ koha-create --create-db test
2. Initiate all the things
3. Enable and start the z3950 responder
   $ koha-z3950-responder --enable test
   $ koha-z3950-responder --start test
4. Try doing some search:
   $ yaz-client localhost:2100
=> FAIL: you get:
Connecting...OK.
Sent initrequest.
Target closed connection
Z> quit
See you later, alligator.
=> FAIL: No warning or anything on the logs
5. Stop the daemon
   $ koha-z3950-responder --stop test
6. Run it manually:
   $ PERL5LIB=/usr/share/koha/lib KOHA_CONF=/etc/koha/sites/test/koha-conf.xml \
              /usr/bin/perl /usr/share/koha/bin/z3950_responder.pl \
              -c /etc/koha/sites/test/z3950 -u test-koha \
              -p /var/run/koha/test/z3950-responder.pid -d test-koha-z3950
7. Repeat the 4, on a separate terminal (no daemon mode this time)
=> FAIL: You get:
Cannot open /etc/koha/sites/test/log4perl.conf (Permission denied) at /usr/share/perl5/Log/Log4perl/Config/BaseConfigurator.pm line 51.
8. Change the file owner:
   $ chown test-koha /etc/koha/sites/test/log4perl.conf
9. Repeat 6, and 4
=> SUCCESS: It doesn't break anymore!
10. Apply this patch
11. Create a new instance, with the patched koha-create:
    $ debian/scripts/koha-create --create-db test1
12: Check the generated files permissions:
    $ ls -l /etc/koha/sites/test2
=> SUCCESS: You get:
-rw-r----- 1 root       test2-koha 19720 May 17 13:26 koha-conf.xml
-rw-r----- 1 test2-koha test2-koha  2825 May 17 13:26 log4perl.conf
-rw-r----- 1 root       test2-koha  2014 May 17 13:26 zebra-authorities-dom.cfg
-rw-r----- 1 root       test2-koha  2279 May 17 13:26 zebra-biblios-dom.cfg
-rw-r----- 1 root       test2-koha    26 May 17 13:26 zebra.passwd

13. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Comment 3 Martin Renvoize 2021-05-27 08:52:41 UTC
Created attachment 121444 [details] [review]
Bug 28364: Make log4perl.conf belong to the instance user

This patch makes koha-create generate the log4perl.conf file for the
instance, belonging to the instance user. This is done in order to have
the z3950 responder work.

My original idea was to make the responder accept a '-g' parameter but
that is not supported by Net::Z3950::Responder. Also, as the library
insists on handling the PID file on its own, it wont' work to handle the
responsability to start-stop-daemon. The only solution I found was
making the fiel be owned by the instance user.

1. Create a Koha instance:
   $ koha-create --create-db test
2. Initiate all the things
3. Enable and start the z3950 responder
   $ koha-z3950-responder --enable test
   $ koha-z3950-responder --start test
4. Try doing some search:
   $ yaz-client localhost:2100
=> FAIL: you get:
Connecting...OK.
Sent initrequest.
Target closed connection
Z> quit
See you later, alligator.
=> FAIL: No warning or anything on the logs
5. Stop the daemon
   $ koha-z3950-responder --stop test
6. Run it manually:
   $ PERL5LIB=/usr/share/koha/lib KOHA_CONF=/etc/koha/sites/test/koha-conf.xml \
              /usr/bin/perl /usr/share/koha/bin/z3950_responder.pl \
              -c /etc/koha/sites/test/z3950 -u test-koha \
              -p /var/run/koha/test/z3950-responder.pid -d test-koha-z3950
7. Repeat the 4, on a separate terminal (no daemon mode this time)
=> FAIL: You get:
Cannot open /etc/koha/sites/test/log4perl.conf (Permission denied) at /usr/share/perl5/Log/Log4perl/Config/BaseConfigurator.pm line 51.
8. Change the file owner:
   $ chown test-koha /etc/koha/sites/test/log4perl.conf
9. Repeat 6, and 4
=> SUCCESS: It doesn't break anymore!
10. Apply this patch
11. Create a new instance, with the patched koha-create:
    $ debian/scripts/koha-create --create-db test1
12: Check the generated files permissions:
    $ ls -l /etc/koha/sites/test2
=> SUCCESS: You get:
-rw-r----- 1 root       test2-koha 19720 May 17 13:26 koha-conf.xml
-rw-r----- 1 test2-koha test2-koha  2825 May 17 13:26 log4perl.conf
-rw-r----- 1 root       test2-koha  2014 May 17 13:26 zebra-authorities-dom.cfg
-rw-r----- 1 root       test2-koha  2279 May 17 13:26 zebra-biblios-dom.cfg
-rw-r----- 1 root       test2-koha    26 May 17 13:26 zebra.passwd

13. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 4 Martin Renvoize 2021-05-27 08:53:11 UTC
All works as expected now, thanks.

Passing QA
Comment 5 Jonathan Druart 2021-05-27 15:13:48 UTC
This has been hidden because of a chown in misc4dev, maybe we should revert it.

https://gitlab.com/koha-community/koha-misc4dev/-/issues/43
Comment 6 Jonathan Druart 2021-05-27 15:28:18 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 7 Fridolin Somers 2021-05-31 14:44:39 UTC
Pushed to 20.11.x for 20.11.07
Comment 8 Victor Grousset/tuxayo 2021-06-08 23:27:04 UTC
Backported: Pushed to 20.05.x branch for 20.05.13
Comment 9 wainuiwitikapark 2021-06-15 23:07:03 UTC
Does this need to backported to 19.11.x?
Comment 10 wainuiwitikapark 2021-06-17 01:57:04 UTC
Backported to 19.11.x for 19.11.19
Comment 11 David Cook 2022-09-23 02:26:05 UTC
This was driving me absolutely crazy this morning.

Note that this still affects any upgraded Koha. I was trying to use koha-z3950-responder for a current Koha that has been upgraded many times, and yeah... very very frustrating.
Comment 12 Victor Grousset/tuxayo 2022-09-23 03:06:58 UTC
So what to run to manually fix existing instances?
Comment 13 David Cook 2022-09-23 03:42:02 UTC
(In reply to Victor Grousset/tuxayo from comment #12)
> So what to run to manually fix existing instances?

Well manually you can just change the permission using chown based on which Koha user should own it. 

--

Automatically... I've opened Bug 31612 for that one, although I probably won't provide a patch...

I'd say some kind of audit script that checks the permissions of files and then updates them based on their location.

For example, if it's in /etc/koha/sites/kohadev/* then it updates owner to kohadev-koha. 

Lots of different ways to do it which means folk might disagree on how to do it...