HomeClusterLabs Projects

Test: cts-fencing: use temporary directory for log files

Description

Test: cts-fencing: use temporary directory for log files

Previously, cts-fencing used a fixed log name for pacemaker-fenced, and
a secure temporary file for the corosync log.

However, newer Linux kernels have an optional security feature to
prevent a user from opening a file for creation/writing in a
world-writeable sticky directory when that file already exists and is
owned by a different user. Pacemaker changes a log file's ownership to
hacluster then reopens it with libqb, which fails in this situation.

Now, create a secure temporary directory, then create the
pacemaker-fenced and corosync logs as fixed names within that.
That avoids the problem and has the bonus of automatically removing the
directory and its contents when done.

See "protected_regular" at:
https://www.kernel.org/doc/Documentation/admin-guide/sysctl/fs.rst

Details

Provenance
kgaillotAuthored on May 17 2021, 5:59 PM
Parents
rPc2531d8397b7: Low: executor,fencer: tell user if additional logfile is unusable
Branches
Unknown
Tags
Unknown

Event Timeline