search

basho / node_package

RPM/Debian/FreeBSD/SmartOS/Solaris/OSX packaging templates for Erlang Nodes
Apache License 2.0
89 stars 63 forks source link

Prevent root ownership of Erlang cookie in platform data directory #145

Closed hectcastro closed 10 years ago

hectcastro commented 10 years ago

The process for pinging a Riak node does not go through the bootstrap procedure so that non-root users can easily detect if Riak is up/down.

When using the service command to manage the Riak service, any subcommands to the Riak runner that make use of ping (AKA ping_node()) can inadvertently create a root owned .erlang.cookie inside /var/lib/riak. This causes problems when the Riak user attempts to read the Erlang cookie later.

This change makes it so that if ping_node() gets called by root in any way, the home directory is explicitly set to /root. That prevents future issues around reading /var/lib/riak/.erlang.cookie.

Basic tests

Can I start Riak with the service command:

$ sudo service riak start

Can I ping Riak with the service command:

$ sudo service riak ping

Can I ping Riak with a non-root user:

$ riak ping

Platforms to test

jburwell commented 10 years ago

I tested on Ubuntu 12.04.4 using the 2.0.0beta7 package with Vagrant and the ansible-riak 2.0 branch the following steps:

  1. Create an Ubuntu 12.04.4 VM using the chef/ubuntu-12.04 box
  2. Install the 2.0.0beta7 package
  3. Overlay the env.sh changes from this PR
  4. Overlay the /etc/init.d/riak changes from this PR
  5. service start riak

Following this procedure, startup failed with the following issue:

msg: vm.args needs to have a -name parameter.
  -sname is not supported.

failed: [riak-01] => {"failed": true}
failed: [riak-02] => {"failed": true}
msg: vm.args needs to have a -name parameter.
  -sname is not supported.

msg: vm.args needs to have a -name parameter.
  -sname is not supported.

Please see the basho/ansible-riak@a54f18763565593578f8057c962ca8133650f54f revision for the exact ansible-riak version that caused this error.

jburwell commented 10 years ago

@hectcastro noticed that I failed to replace the template variables in the env.sh patch. After replacing them with the Ubuntu/Debian values, this patch corrects the startup issue on Ubuntu/Debian.

I pushed the corrected patch to basho/ansible-riak@9f88cc81b1d0cfea6505205c49a67303887e572c.

jaredmorrow commented 10 years ago

Fixed in https://github.com/basho/node_package/pull/146