file system permissions are broken

[MrTango]

In the current master and also in the tag 1.2.8 the file system permissions are broken:

root@plone-test1-deb8-32bit:/usr/local/plone-4.3/example# su plone_daemon 
$ pwd
/usr/local/plone-4.3/example
$ ./bin/client_reserved run scripts/addPloneSite.py  
Traceback (most recent call last):
  File "/usr/local/plone-4.3/example/parts/client_reserved/bin/interpreter", line 260, in <module>
    exec(_val)
  File "<string>", line 1, in <module>
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.23-py2.7.egg/Zope2/__init__.py", line 51, in app
    startup()
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.23-py2.7.egg/Zope2/__init__.py", line 47, in startup
    _startup()
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.23-py2.7.egg/Zope2/App/startup.py", line 81, in startup
    DB = dbtab.getDatabase('/', is_root=1)
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.23-py2.7.egg/Zope2/Startup/datatypes.py", line 287, in getDatabase
    db = factory.open(name, self.databases)
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.23-py2.7.egg/Zope2/Startup/datatypes.py", line 185, in open
    DB = self.createDB(database_name, databases)
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.23-py2.7.egg/Zope2/Startup/datatypes.py", line 182, in createDB
    return ZODBDatabase.open(self, databases)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZODB/config.py", line 101, in open
    storage = section.storage.open()
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZODB/config.py", line 220, in open
    **options)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZEO/ClientStorage.py", line 387, in __init__
    self.fshelper = ZODB.blob.FilesystemHelper(blob_dir)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZODB/blob.py", line 330, in __init__
    layout_name = auto_layout_select(base_dir)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZODB/blob.py", line 516, in auto_layout_select
    for name in os.listdir(path):
OSError: [Errno 13] Permission denied: '/var/local/plone-4.3/example/blobstorage'

tag 1.2.5 works with the same playbook.
OS: Debian 32bit on DiagitalOcean

[smcmahon]

I need some help with this one: I'm unable to reproduce the problem.

I've run tests with both Trusty and Jessie, and in both cases blobstorage ends up owned by plone_daemon and there's no problem with the step that adds the Plone site.

Any clues as to what's going on? Interim steps?

[MrTango]

ok, I'll try again with some different scenarios to find out in which cases that happen.

[MrTango]

if you let run this playbook on DigitalOcean (Debian8 32bit) with the master of ansible.plone_server it should give you the error below.

$ cat playbook.yml 
---
# vim:ft=ansible:

- hosts: all
  become: yes
  gather_facts: yes

  pre_tasks:
    - name: Update apt cache if needed.
      apt: update_cache=yes cache_valid_time=3600

    - name: Ensure required packages
      apt: pkg={{ item }} state=present
      with_items:
        - nginx
        - vim-nox
        - git
        - openssl
        - sudo
        - build-essential
        - python-dev
        - python-virtualenv
        - python-pip
        - libz-dev
        - libssl-dev
        - libjpeg-dev
        - libxslt1-dev
        - libjpeg-dev
        - libopenjpeg-dev
        - libfreetype6-dev
        - libwebp-dev
        - poppler-utils
        - wv
        - lynx-cur
        - unzip
        - supervisor

    - name: Update host
      apt: upgrade=dist update_cache=yes

    - name: Add ansible user
      user: name=ansible shell=/bin/bash groups=sudo append=yes

  roles:

    - role: jdauphant.nginx
      tags: nginx
      nginx_http_params:
        - sendfile "on"
        - client_max_body_size "50m"
        - access_log "/var/log/nginx/access.log" 
      nginx_sites:
        client1:
          - listen 80
          - location / { proxy_pass http://127.0.0.1:8081/VirtualHostBase/http/test.derico.de:80/Plone/VirtualHostRoot/; }

    - role: ansible.plone_server
      plone_instance_name: plone01
      plone_site_id: Plone
      plone_default_language: de
      plone_major_version: '4.3'
      plone_version: '4.3.9'
      plone_initial_password: admin

      plone_zserver_threads: 2
      plone_additional_eggs:
        - plone.app.mosaic
        - plone.app.widgets
      plone_zcml_slugs:
      plone_additional_versions:
        - "Products.PloneFormGen = 1.7.19"
        - "Products.EasyNewsletter = 2.6.15"
        - "plone.tiles = 1.5.2"
        - "plone.app.tiles = 2.2.1"
        - "plone.app.standardtiles = 1.0"
        - "plone.app.blocks = 3.1.0"
        - "plone.app.drafts = 1.0"
        - "plone.app.widgets = 1.8.0"
      plone_sources:

The error:

cmd: bin/client_reserved run scripts/addPloneSite.py

start: 2016-05-30 04:32:51.757217

end: 2016-05-30 04:33:06.598990

delta: 0:00:14.841773

stderr: Traceback (most recent call last):
  File "/usr/local/plone-4.3/plone01/parts/client_reserved/bin/interpreter", line 270, in <module>
    exec(_val)
  File "<string>", line 1, in <module>
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.24-py2.7.egg/Zope2/__init__.py", line 51, in app
    startup()
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.24-py2.7.egg/Zope2/__init__.py", line 47, in startup
    _startup()
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.24-py2.7.egg/Zope2/App/startup.py", line 81, in startup
    DB = dbtab.getDatabase('/', is_root=1)
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.24-py2.7.egg/Zope2/Startup/datatypes.py", line 287, in getDatabase
    db = factory.open(name, self.databases)
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.24-py2.7.egg/Zope2/Startup/datatypes.py", line 185, in open
    DB = self.createDB(database_name, databases)
  File "/usr/local/plone-4.3/buildout-cache/eggs/Zope2-2.13.24-py2.7.egg/Zope2/Startup/datatypes.py", line 182, in createDB
    return ZODBDatabase.open(self, databases)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZODB/config.py", line 101, in open
    storage = section.storage.open()
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZODB/config.py", line 220, in open
    **options)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZEO/ClientStorage.py", line 387, in __init__
    self.fshelper = ZODB.blob.FilesystemHelper(blob_dir)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZODB/blob.py", line 330, in __init__
    layout_name = auto_layout_select(base_dir)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-i686.egg/ZODB/blob.py", line 516, in auto_layout_select
    for name in os.listdir(path):
OSError: [Errno 13] Permission denied: '/var/local/plone-4.3/plone01/blobstorage'

NO MORE HOSTS LEFT *************************************************************
    to retry, use: --limit @playbook.retry

The permission settings in this path are:

root@debian-512mb-fra1-01:~# ls -la  /var/local/plone-4.3/plone01/blobstorage
total 8
drwx--S--- 2 plone_buildout plone_group 4096 May 30 04:23 .
drwxrws--- 9 plone_daemon   plone_group 4096 May 30 04:28 ..
root@debian-512mb-fra1-01:~# ls -la  /var/local/plone-4.3/plone01/
total 36
drwxrws--- 9 plone_daemon   plone_group 4096 May 30 04:28 .
drwxr-xr-x 4 root           staff       4096 May 30 04:22 ..
drwx--S--- 2 plone_buildout plone_group 4096 May 30 04:23 blobstorage
drwxr-sr-x 3 plone_buildout plone_group 4096 May 30 04:23 client1
drwxr-sr-x 3 plone_buildout plone_group 4096 May 30 04:28 client2
drwxr-sr-x 3 plone_buildout plone_group 4096 May 30 04:28 client_reserved
drwxr-sr-x 2 plone_buildout plone_group 4096 May 30 04:23 filestorage
drwx------ 2 plone_daemon   plone_group 4096 May 30 04:22 .python-eggs
drwxr-sr-x 2 plone_buildout plone_group 4096 May 30 04:23 zeoserver

[MrTango]

I've testen with tag 1.2.6 also and this has the same Problem. Only tag 1.2.5 works.

[smcmahon]

Thanks! I'll tackle this as soon as I'm back from PyCon US.

[smcmahon]

OK, this is frustrating. I wasn't able to reproduce the problem. I tried with Jessie 8.3 64 via Vagrant and a brand-new 8.3 32-bit on digital ocean. The playbook ran with no problems. (ansible-playbook 2.1.0.0)

I'm testing with the plone_server and jdauphant.nginx from their master branches.

Anything done to the server environment before running the playbook?

[MrTango]

No, I created a new droplet debian 8 32bit, location Frankfurt and ran the playbook above. ansible-playbook 2.0.2.0 but I'll try the version 2.1.0.0. soon.

[MrTango]

Hm, interesting, it works with ansible-2.1.0.0 but not with 2.0.2.0 which comes with Debian ;)

[smcmahon]

That is very interesting.

[djowett]

I'm seeing similar on Plone 4.3.7 / Ubuntu 14.04

If I try backup with plone_daemon I get:

$ sudo -u plone_daemon bin/zipbackup
INFO: Please wait while backing up database file: /var/local/plone-4.3/demo/filestorage/Data.fs to /usr/local/plone-4.3/demo/var/zipbackups
No handlers could be found for logger "ZODB.FileStorage"
Traceback (most recent call last):
  File "/usr/local/plone-4.3/demo/bin/repozo", line 23, in <module>
    sys.exit(ZODB.scripts.repozo.main())
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-x86_64.egg/ZODB/scripts/repozo.py", line 611, in main
    do_backup(options)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-x86_64.egg/ZODB/scripts/repozo.py", line 500, in do_backup
    do_full_backup(options)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-x86_64.egg/ZODB/scripts/repozo.py", line 447, in do_full_backup
    fs._index.save(pos, index_file)
  File "/usr/local/plone-4.3/buildout-cache/eggs/ZODB3-3.10.5-py2.7-linux-x86_64.egg/ZODB/fsIndex.py", line 99, in save
    with open(fname, 'wb') as f:
IOError: [Errno 13] Permission denied: '/usr/local/plone-4.3/demo/var/zipbackups/2016-06-16-18-42-43.index'
ERROR: Repozo command failed. See message above.
ERROR: Halting execution due to error; not backing up blobs.

If I try it with plone_buildout I get:

$ sudo -u plone_buildout bin/zipbackup
INFO: Please wait while backing up database file: /var/local/plone-4.3/demo/filestorage/Data.fs to /usr/local/plone-4.3/demo/var/zipbackups
No handlers could be found for logger "ZODB.FileStorage"
INFO: Removed 4 file(s) belonging to old backups, the latest 1 full backups have been kept.
INFO: Please wait while backing up blobs from /var/local/plone-4.3/demo/blobstorage to /usr/local/plone-4.3/demo/var/blobstoragezips
INFO: Renaming blobstorage.0.tar.gz to blobstorage.1.tar.gz.
INFO: tar czf /usr/local/plone-4.3/demo/var/blobstoragezips/blobstorage.0.tar.gz -C /var/local/plone-4.3/demo/blobstorage .
tar: /var/local/plone-4.3/demo/blobstorage: Cannot open: Permission denied
tar: Error is not recoverable: exiting now

I guess it's plone_buildout mean't to be running backups?

[djowett]

Ok, I'm mistaken it's meant to be plone_daemon running backups

My permissions were:

$ ls -al /var/local/plone-4.3/demo/
total 32
drwxrws--- 8 plone_daemon   plone_group 4096 Jun 16 13:55 .
drwxr-xr-x 4 root           staff       4096 Jun 14 14:08 ..
drwx--S--- 3 plone_daemon   plone_group 4096 Jun 16 13:55 blobstorage
drwxrws--- 3 plone_buildout plone_group 4096 Jun 17 06:39 client1
drwxrws--- 3 plone_buildout plone_group 4096 Jun 16 13:54 client_reserved
drwxrws--- 2 plone_buildout plone_group 4096 Jun 16 13:55 filestorage
drwx------ 2 plone_daemon   plone_group 4096 Jun 14 14:08 .python-eggs
drwxrws--- 2 plone_buildout plone_group 4096 Jun 16 13:55 zeoserver

I note my blobstorage is owned by plone_daemon rather than plone_buildout, but I figured that the main issue was the missing group permissions. I fixed it manually with chmod -R 2770 /var/local/plone-4.3/highfields_demo/blobstorage/. I don't know what sets the permissions & ownership of blobstorage, but it doesn't seem to me to be the Ansible playbook or role, so perhaps the problem & solution are elsewhere in Plone?

[smcmahon]

The var directory can have files created by buildout or by the ZEO server and client processes. That's why we've got the plone_group and the unusual setgid bits. The blobstorage directory itself is created by the zeoserver daemon.

[djowett]

So is 2770 the correct permissions for thé blobstorage directory ?

---- Steve McMahon wrote ----

The var directory can have files created by buildout or by the ZEO server and client processes. That's why we've got the plone_group and the unusual setgid bits. The blobstorage directory itself is created by the zeoserver daemon.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[smcmahon]

"Correct" is any ownership/permissions that allows the daemon to write to the directory.