saltstack / salt

Software to automate the management and configuration of any infrastructure or application at scale. Install Salt from the Salt package repositories here:
https://docs.saltproject.io/salt/install-guide/en/latest/
Apache License 2.0
14.19k stars 5.48k forks source link

[BUG] file/folder permission issue when using saltutil.runner execution module function on a 3006 master #65653

Open lomeroe opened 11 months ago

lomeroe commented 11 months ago

Description When using the saltutil.runner minion function on a master, folders/files created in /var/cache/salt/master/jobs are owned by root:root and unable to be accessed/cleaned by the master running as the salt user

Eventually, log entries like following will appear in the master's log file:

2023-11-29 12:59:10,399 [salt.loaded.int.returner.local_cache:405 ][ERROR   ][61417] Unable to remove /var/cache/salt/master/jobs/b4/f4cc3887720720eeff5b9b2ebc282a43cd106e6d2c111ed8d82fdc6c4dd834: [Errno 13] Permission denied: 'jid'

Setup 3006 onedir minion/master

Please be as specific as possible and give set-up details.

Steps to Reproduce the behavior

$sudo salt-call saltutil.runner cache.fetch bank='some/bank' key="some-key" cachedir="/var/cache/salt"
$sudo find /var/cache/salt/master/jobs/ -user root

Expected behavior Files/folders in /var/cache/salt/master/jobs are owned by salt:salt so the master can access/clean/etc

Screenshots N/A

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.) ```yaml salt-call --versions-report Salt Version: Salt: 3006.4 Python Version: Python: 3.10.13 (main, Oct 4 2023, 21:54:22) [GCC 11.2.0] Dependency Versions: cffi: 1.14.6 cherrypy: 18.6.1 dateutil: 2.8.1 docker-py: Not Installed gitdb: Not Installed gitpython: Not Installed Jinja2: 3.1.2 libgit2: Not Installed looseversion: 1.0.2 M2Crypto: Not Installed Mako: Not Installed msgpack: 1.0.2 msgpack-pure: Not Installed mysql-python: Not Installed packaging: 22.0 pycparser: 2.21 pycrypto: Not Installed pycryptodome: 3.9.8 pygit2: Not Installed python-gnupg: 0.4.8 PyYAML: 6.0.1 PyZMQ: 23.2.0 relenv: 0.13.12 smmap: Not Installed timelib: 0.2.4 Tornado: 4.5.3 ZMQ: 4.3.4 System Versions: dist: ubuntu 22.04.3 jammy locale: utf-8 machine: x86_64 release: 6.2.0-1016-aws system: Linux version: Ubuntu 22.04.3 jammy ```

Additional context None

tj90241 commented 11 months ago

A a workaround, I set verify_env on any minion which resides on the same host as a master to False. Then restarted both that minion and master. Seemed to fix at least what was a similar issue for me. https://docs.saltproject.io/en/latest/ref/configuration/master.html#verify-env