koha-zebra is unable to stop and start a zebra process if ownership on /var/run/koha/instancename is wrong it already checks permissions on the relevant log files, it should also check on this directory
Created attachment 164525 [details] [review] Bug 36548: koha-zebra should fix ownership on /var/run/koha/instancename files This patch ensures the /var/run/koha/instancename/* files are owned by instancename-koha so zebra can start and stop as expected. To test, confirm that: 1. starting and stopping zebra using `koha-zebra` works as expected 2. all files in /var/run/koha/instancename/ are owned by instancename-koha Sponsored-by: Catalyst IT
*** Bug 30260 has been marked as a duplicate of this bug. ***
Using KTD, the patch also changes the permissions for the file z3950-responder.pid - they are root before the patch is applied. I don't know what effect this will have, or whether it is currently incorrect. Happy to sign off if you consider there are no issues. Z3950-responder information: https://wiki.koha-community.org/wiki/Setting_up_the_Z39.50_and_SRU_Server Before the patch (using KTD), the permissions are: ls -la /var/run/koha/kohadev/ total 60 drwxr-xr-x 4 kohadev-koha kohadev-koha 4096 May 2 23:04 . drwxr-xr-x 3 root root 4096 May 2 22:58 .. drwxr-xr-x 2 kohadev-koha kohadev-koha 4096 May 2 22:58 authorities srw-rw-rw- 1 kohadev-koha kohadev-koha 0 May 2 22:59 authoritysocket drwxr-xr-x 2 kohadev-koha kohadev-koha 4096 May 2 22:58 biblios srw-rw-rw- 1 kohadev-koha kohadev-koha 0 May 2 22:59 bibliosocket -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-indexer.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-indexer.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:58 kohadev-koha-sip.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-worker.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-worker-long_tasks.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-worker-long_tasks.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-worker.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-zebra.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-zebra.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:58 plack.pid srwxr-xr-x 1 kohadev-koha kohadev-koha 0 May 2 22:58 plack.sock -rw-r--r-- 1 root root 4 May 2 22:59 z3950-responder.pid After the patch, the permissions (after stopping and restarting Zebra) are: ls -la /var/run/koha/kohadev/ total 60 drwxr-xr-x 4 kohadev-koha kohadev-koha 4096 May 2 23:05 . drwxr-xr-x 3 root root 4096 May 2 22:58 .. drwxr-xr-x 2 kohadev-koha kohadev-koha 4096 May 2 22:58 authorities srw-rw-rw- 1 kohadev-koha kohadev-koha 0 May 2 23:05 authoritysocket drwxr-xr-x 2 kohadev-koha kohadev-koha 4096 May 2 22:58 biblios srw-rw-rw- 1 kohadev-koha kohadev-koha 0 May 2 23:05 bibliosocket -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-indexer.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-indexer.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:58 kohadev-koha-sip.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-worker.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-worker-long_tasks.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-worker-long_tasks.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:59 kohadev-koha-worker.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 23:05 kohadev-koha-zebra.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 23:05 kohadev-koha-zebra.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 May 2 22:58 plack.pid srwxr-xr-x 1 kohadev-koha kohadev-koha 0 May 2 22:58 plack.sock -rw-r--r-- 1 kohadev-koha kohadev-koha 4 May 2 22:59 z3950-responder.pid
More information from when trying to restart the z3950 responder: sudo koha-z3950-responder --restart kohadev Restarting Z39.50/SRU daemon for kohadev:Stopping Z39.50/SRU daemon for kohadev:start-stop-daemon: matching only on non-root pidfile /var/run/koha/kohadev/z3950-responder.pid is insecure failed! failed! If I change it back to being owned by root, it restarts as normal: sudo koha-z3950-responder --restart kohadev Restarting Z39.50/SRU daemon for kohadev:Stopping Z39.50/SRU daemon for kohadev:. Starting Z39.50/SRU daemon for kohadev:.
Should this be FQA? Sounds like it to me.
(In reply to Magnus Enger from comment #5) > Should this be FQA? Sounds like it to me. No response in ~4 months, setting to FQA.
Created attachment 174390 [details] [review] Bug 36548: koha-zebra should fix ownership on /var/run/koha/instancename files This patch ensures the /var/run/koha/instancename/* files are owned by instancename-koha so zebra can start and stop as expected. Note: /var/run/koha/instancename/z3950-responder.pid must be owned by root:root but the rest should be owned by instancename-koha To test, confirm that: 1. starting and stopping zebra using `koha-zebra` works as expected 2. all files in /var/run/koha/instancename/ are owned by instancename-koha Sponsored-by: Catalyst IT
Created attachment 175586 [details] [review] Bug 36548: koha-zebra should fix ownership on /var/run/koha/instancename files This patch ensures the /var/run/koha/instancename/* files are owned by instancename-koha so zebra can start and stop as expected. Note: /var/run/koha/instancename/z3950-responder.pid must be owned by root:root but the rest should be owned by instancename-koha To test, confirm that: 1. starting and stopping zebra using `koha-zebra` works as expected 2. all files in /var/run/koha/instancename/ are owned by instancename-koha Sponsored-by: Catalyst IT Signed-off-by: David Nind <david@davidnind.com>
It is a bit weird to see 'plack' here. I see two options. 1) Explicitly name Zebra-related things: * /var/lib/koha/{name}/authorities * /var/lib/koha/{name}/authoritysocket * /var/lib/koha/{name}/biblios * /var/lib/koha/{name}/bibliosocket * /var/lib/koha/{name}/{name}-koha-zebra.clientpid * /var/lib/koha/{name}/{name}-koha-zebra.pid 2) Add some function in `koha-functions.sh` that fixes permissions (pretty much the way `koha-create-dirs` does. The reason for (2) is why do it in koha-zebra and not on every startup script?
(In reply to Aleisha Amohia from comment #7) > > Note: /var/run/koha/instancename/z3950-responder.pid must be owned by > root:root but the rest should be owned by instancename-koha This is annoying isn't it.
Created attachment 186349 [details] [review] Bug 36548: koha-zebra should fix ownership on /var/run/koha/instancename files This patch ensures the zebra-related /var/run/koha/instancename/* files are owned by instancename-koha so zebra can start and stop as expected. Note: /var/run/koha/instancename/z3950-responder.pid must be owned by root:root but the rest should be owned by instancename-koha To test, confirm that: 1. starting and stopping zebra using `koha-zebra` works as expected 2. all files in /var/run/koha/instancename/ are owned by instancename-koha Sponsored-by: Catalyst IT Signed-off-by: David Nind <david@davidnind.com>
(In reply to Tomás Cohen Arazi (tcohen) from comment #9) > It is a bit weird to see 'plack' here. > > I see two options. > > 1) Explicitly name Zebra-related things: > > * /var/lib/koha/{name}/authorities > * /var/lib/koha/{name}/authoritysocket > * /var/lib/koha/{name}/biblios > * /var/lib/koha/{name}/bibliosocket > * /var/lib/koha/{name}/{name}-koha-zebra.clientpid > * /var/lib/koha/{name}/{name}-koha-zebra.pid > > 2) Add some function in `koha-functions.sh` that fixes permissions (pretty > much the way `koha-create-dirs` does. > > The reason for (2) is why do it in koha-zebra and not on every startup > script? Thanks Tomas, I opted for Option 1 for the sake of moving this along, but it would be great to open a bug report for Option 2 to affect other scripts.
I've finally retested! The only thing I noted is that the authorities and biblios directories aren't changed. If that is not an issue, then I'm happy to sign off. Testing notes (using KTD): 1. Start up KTD: ktd up 2. Access the shell: ktd --shell 3. List the files and note the permissions: ls -la /var/run/koha/kohadev/ [1] 4. Change the ownership of all the files--except z3950-responder.pid--in /var/run/koha/kohadev to root [2] 5. Restart Zebra: sudo koha-zebra --restart kohadev 6. Only the kohadev-koha-zebra.clientpid and kohadev-koha-zebra.pid files are changed back to being owned by kohadev-koha 7. Apply the patch and restart everything 8. Ownership changed for all files EXCEPT: - authorities and biblios (these are directories, and are empty for me) - z3950-responder.pid (needs to be owned by root) [1] Folder ownership after KTD has started up ============================================= ls -la /var/run/koha/kohadev/ total 64 drwxr-xr-x 4 kohadev-koha kohadev-koha 4096 Dec 26 21:01 . drwxr-xr-x 3 root root 4096 Dec 26 21:00 .. drwxr-xr-x 2 kohadev-koha kohadev-koha 4096 Dec 26 21:00 authorities srw-rw-rw- 1 kohadev-koha kohadev-koha 0 Dec 26 21:01 authoritysocket drwxr-xr-x 2 kohadev-koha kohadev-koha 4096 Dec 26 21:00 biblios srw-rw-rw- 1 kohadev-koha kohadev-koha 0 Dec 26 21:01 bibliosocket -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 kohadev-koha-indexer.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 kohadev-koha-indexer.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 4 Dec 26 21:01 kohadev-koha-sip.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 4 Dec 26 21:01 kohadev-koha-sip.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 kohadev-koha-worker.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 kohadev-koha-worker-long_tasks.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 kohadev-koha-worker-long_tasks.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 kohadev-koha-worker.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 kohadev-koha-zebra.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 kohadev-koha-zebra.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:01 plack.pid srwxr-xr-x 1 kohadev-koha kohadev-koha 0 Dec 26 21:01 plack.sock -rw-r--r-- 1 root root 4 Dec 26 21:01 z3950-responder.pid [2] Before the patch, after changing ownership and restarting Zebra =================================================================== Change everything to root: - sudo chown root:root /var/run/koha/kohadev/kohadev - sudo chown root:root /var/run/koha/kohadev/plack* - sudo chown root:root /var/run/koha/kohadev/authorit* - sudo chown root:root /var/run/koha/kohadev/biblios* Restart Zebra: sudo koha-zebra --restart kohadev ls -la /var/run/koha/kohadev/ total 64 drwxr-xr-x 4 kohadev-koha kohadev-koha 4096 Dec 26 21:38 . drwxr-xr-x 3 root root 4096 Dec 26 21:00 .. drwxr-xr-x 2 root root 4096 Dec 26 21:00 authorities srw-rw-rw- 1 kohadev-koha kohadev-koha 0 Dec 26 21:38 authoritysocket drwxr-xr-x 2 root root 4096 Dec 26 21:00 biblios srw-rw-rw- 1 kohadev-koha kohadev-koha 0 Dec 26 21:38 bibliosocket -rw-r--r-- 1 root root 5 Dec 26 21:01 kohadev-koha-indexer.clientpid -rw-r--r-- 1 root root 5 Dec 26 21:01 kohadev-koha-indexer.pid -rw-r--r-- 1 root root 4 Dec 26 21:01 kohadev-koha-sip.clientpid -rw-r--r-- 1 root root 4 Dec 26 21:01 kohadev-koha-sip.pid -rw-r--r-- 1 root root 5 Dec 26 21:01 kohadev-koha-worker.clientpid -rw-r--r-- 1 root root 5 Dec 26 21:01 kohadev-koha-worker-long_tasks.clientpid -rw-r--r-- 1 root root 5 Dec 26 21:01 kohadev-koha-worker-long_tasks.pid -rw-r--r-- 1 root root 5 Dec 26 21:01 kohadev-koha-worker.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:38 kohadev-koha-zebra.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 21:38 kohadev-koha-zebra.pid -rw-r--r-- 1 root root 5 Dec 26 21:01 plack.pid srwxr-xr-x 1 root root 0 Dec 26 21:01 plack.sock -rw-r--r-- 1 root root 4 Dec 26 21:01 z3950-responder.pid After the patch, after changing ownership and restarting Zebra ============================================================== After applying the patch and restarting everything (which includes Zebra): - ownership of the authorities and biblios directories aren't changed - ownership of z3950-responder.pid isn't changed (as expected) ls -la /var/run/koha/kohadev/ total 64 drwxr-xr-x 4 kohadev-koha kohadev-koha 4096 Dec 26 22:13 . drwxr-xr-x 3 root root 4096 Dec 26 21:00 .. drwxr-xr-x 2 root root 4096 Dec 26 21:00 authorities srw-rw-rw- 1 kohadev-koha kohadev-koha 0 Dec 26 22:13 authoritysocket drwxr-xr-x 2 root root 4096 Dec 26 21:00 biblios srw-rw-rw- 1 kohadev-koha kohadev-koha 0 Dec 26 22:13 bibliosocket -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-indexer.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-indexer.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-sip.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-sip.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-worker.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-worker-long_tasks.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-worker-long_tasks.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-worker.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-zebra.clientpid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 kohadev-koha-zebra.pid -rw-r--r-- 1 kohadev-koha kohadev-koha 5 Dec 26 22:13 plack.pid srwxr-xr-x 1 kohadev-koha kohadev-koha 0 Dec 26 22:13 plack.sock -rw-r--r-- 1 root root 4 Dec 26 22:13 z3950-responder.pid