[Bug 14774] New: Task Scheduler not working on Ubuntu/Apache2.4
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14774 Bug ID: 14774 Summary: Task Scheduler not working on Ubuntu/Apache2.4 Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Task Scheduler Assignee: gmcharlt@gmail.com Reporter: liz@catalyst.net.nz QA Contact: testopia@bugs.koha-community.org The task scheduler uses At to schedule reports to be run later. It's doing something weird in Ubuntu 14, Apache 2.4. Scheduling a task on Debian/Apache 2.2 results in the job being added, and it showing up in the web page. This doesn't happen on Ubuntu/Apache 2.4, it returns a "Failed to add job." It looks like Koha is asking atq for the list of current jobs (through Schedule::At) and it's not getting a list back when run on Ubuntu/2.4. This all works just fine in Debian/2.2. in /var/spool/cron/atjobs we can see where jobs are added: Failing job "Failed to add job", Ubuntu, Apache 2.4: ---------- 1 daemon daemon 2.9K Sep 2 15:19 a0004a016e87ae Successful job displays in the web page, Debian, Apache 2.2 -rwx------ 1 library-koha daemon 2.8K Sep 2 16:15 a00014016f1f52 When we ask for the euid/gid of the user when trying to add these failed jobs, it seems like it should be OK: uid: 1005, euid: 1005 Which corresponds to the uid given in /etc/passwd: library-koha:x:1005:1005 As far as I can tell, those daemon:daemon no permissions jobs aren't actually run - how could they, they have no executable permissions. Pretty sure this bug isn't in Koha proper (the scheduler actually works just fine in Debian/2.2), but some interaction or security thing in Ubuntu/Apache 2.4. It might be nice to figure out why it happens, so we can end run the problem (or decide to scrap the At reliant scheduler, which is probably a "should do" anyway). -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14774 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com Assignee|gmcharlt@gmail.com |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14774 Craig Miskell <craig@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |craig@catalyst.net.nz --- Comment #1 from Craig Miskell <craig@catalyst.net.nz> --- It appears based on some debugging that when running under apache-mpm-itk, setuid binaries like 'at' don't have quite enough permissions to do what they need. While it does end up running as daemon.daemon, and can write to files in /var/spool/cron/atjobs/, it fails at the fchown step with EPERM. From the docs for fchown, that means "The effective UID does not match the owner of the file, and the process is not privileged (Linux: it does not have the CAP_FOWNER capability))". Without going deeper, I expect this is a result of mpm-itk dropping capabilities or privileges to get down to the run-time user, and not being able to elevate back up as a result. This would affect any other setuid programs too. Converting to some sort of app-layer (starman? plack?) may solve it, where apache runs as normal, and the application runs out of app processes that run as the correct user from the start, and which can therefore setuid back up. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14774 Liz Rea <liz@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |In Discussion --- Comment #2 from Liz Rea <liz@catalyst.net.nz> --- In additional, unexpected news: Debian Jessie seems to be unaffected, and honestly I expected it would be. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14774 Robin Sheat <robin@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |robin@catalyst.net.nz -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon@bugs.koha-community.org