chtab try to access /etc/xcat/*.sqlite by its own, but this does not work for non-root users

[dhilst]

Hi everybody,

I was testing xCAT with non-root users. I followed the docs for setting up user certificates, etc.. So I fired a chtab key=... and got a timeout.

After some digging, I found (with strace) that chtab was trying to open /etc/xcat/passwd.sqlite by it's own and facing denied access. Bellow is the relevant strace lines... It try about 3 times, at each second, then it times out.

As work around is possible to use sudo /opt/xcat/sbin/chtab ... or tabedit that works fine with non-root users.

getegid()                               = 1000
stat("/etc/xcat/site.sqlite", {st_mode=S_IFREG|0600, st_size=3072, ...}) = 0
open("/etc/xcat/site.sqlite", O_RDWR|O_CREAT|O_CLOEXEC, 0644) = -1 EACCES (Permission denied)
open("/etc/xcat/site.sqlite", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [], 0}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
nanosleep({1, 0}, 0x7ffd45cfa1f0)       = 0
nanosleep({0, 0}, NULL)                 = 0
stat("/etc/xcat/site.sqlite", {st_mode=S_IFREG|0600, st_size=3072, ...}) = 0
open("/etc/xcat/site.sqlite", O_RDWR|O_CREAT|O_CLOEXEC, 0644) = -1 EACCES (Permission denied)
open("/etc/xcat/site.sqlite", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [], 0}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
nanosleep({2, 0}, 0x7ffd45cfa1f0)       = 0
nanosleep({0, 0}, NULL)                 = 0
stat("/etc/xcat/site.sqlite", {st_mode=S_IFREG|0600, st_size=3072, ...}) = 0
open("/etc/xcat/site.sqlite", O_RDWR|O_CREAT|O_CLOEXEC, 0644) = -1 EACCES (Permission denied)
open("/etc/xcat/site.sqlite", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission denied)
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [], 0}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
nanosleep({4, 0}, 0x7ffd45cfa1f0)       = 0
nanosleep({0, 0}, NULL)                 = 0
stat("/etc/xcat/site.sqlite", {st_mode=S_IFREG|0600, st_size=3072, ...}) = 0
open("/etc/xcat/site.sqlite", O_RDWR|O_CREAT|O_CLOEXEC, 0644) = -1 EACCES (Permission denied)

Cheers,

[dhilst]

I forgot to mention the versions

$ rpm -qa | grep xCAT
xCAT-genesis-base-x86_64-2.14-snap201803282249.noarch
xCAT-buildkit-2.13.11-snap201803130745.noarch
xCAT-server-2.13.11-snap201803130745.noarch
xCAT-genesis-base-ppc64-2.14-snap201804041553.noarch
xCAT-genesis-scripts-ppc64-2.13.11-snap201803130745.noarch
perl-xCAT-2.13.11-snap201803130745.noarch
xCAT-probe-2.13.11-snap201803130745.noarch
xCAT-genesis-scripts-x86_64-2.13.11-snap201803130745.noarch
xCAT-client-2.13.11-snap201803130745.noarch
xCAT-2.13.11-snap201803130745.x86_64

[cxhong]

Hi, @dhilst , for this case, you have to use the tabch command,

chtab is designed to work without passing xcatd, so it’s out of control of policy mechanism.
tabch runs as a plugin under the xcatd daemon. This give the additional security of being authorized by the daemon.

@team, is possible can we remove chtab command? or at least we should check if it is not ran by root, we should give out meaningful error message instead of this:

Failed to connect to switches table after retrying 3 times: DBI connect('/etc/xcat/switches.sqlite','',...) failed: unable to open database file at /opt/xcat/lib/perl/xCAT/Table.pm line 972.

Can't call method "prepare" on an undefined value at /opt/xcat/lib/perl/xCAT/Table.pm line 998.

[dhilst]

@cxhong Ohh, thanks for the answer!

A better error message would be good!

Cheers

[immarvin]

hi @cxhong ,where does the error message come from?

[cxhong]

@immarvin , the error messages come from chtab command if it issued by the users

[immarvin]

hi @dhilst , the fix has been merged, would you please take a try ? thx

[dhilst]

@immarvin sure! Excuse my ignorance, I tried /tmp/go-xcat update but I'm still on version 2.14.1, how would I get the update?

Okay I got it:

cd xcat-core
./buildcore.sh

Regards,

[dhilst]

Okay, I got the warning. Thanks for everything!

Regards,

[immarvin]

ok @dhilst , thanks for your confirm. Let me close this ticket