On 02/05/13 11:27, Frank Ch. Eigler wrote:
Ken McDonell <kenj@xxxxxxxxxxxxxxxx> writes:
that started passing when I changed /var/lib/pcp/config/pmda to mode
1777 [...]
(If that were necessary, perhaps we should set up a shared group-id
for the pmda's, so the directory is not open to the world.)
As Dave noted later, and I discovered independently, making
/var/lib/pcp/config/pmda owned by the user pcp appears to be sufficient
for most cases.
The simple PMDA seems to be the main culprit, so I also applied an Irish
(to be sure, to be sure) fix to the Install script there to remove any
of its own PMDA InDom files from this directory before starting a new
invocation of the PMDA.
[...] So changing the mode is only part of the fix ... we need to
consider what to do about migration/upgrade issues where old files
owned by root may be left around. [...]
If it is just chown, there are no upgrade issues.
Can we zap the cache during a make / package install?
No. It is the PMDA implementer's choice to use persistence for their
InDom cache (if they even use the cache services which are optional) and
this is typically done when one wants to maintain the same instance name
to instance number mapping _across_ invocations of the PMDA, e.g. when
the order of instance discovery at start up is non-determinisitic, or
some instances come and go during the life of the PMDA.
Under these circumstances we cannot make unilateral decisions about when
to remove these files.
But the Install script always runs as root, so if it is appropriate (as
in the simple PMDA case above), a PMDA implementer can choose to clean
their own cache at Install time.
The one problem with all of this is that /var/lib/pcp/config/pmda is not
actually included in the PCP package ... it is created on the fly in
libpcp_pmda using the bizarre mkdir2() that used to work when run as
root ... so all that needs to change as well.
I suspect the pmda cache has been disfunctional since the change to
non-root pmcd, especially for a virgin PCP install, (a) because the
/var/lib/pcp/config/pmda did not exist and could not be created, or (b)
because the directory exists but was not writeable. So there is a QA
hole here as well.
And finally, all the chown pcp:pcp changes in the post install package
scripts don't work on Mac OS X because they are driven here from the
user and group options in the idb file (that should shake a few Irix
memories) which we don't set in our GNUmakefile $(INSTALL) lines.
All in all, this will take a while to work through and verify.
|