[Bug 27844] New: koha-worker systemd service should run as %i-koha in package install
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Bug ID: 27844 Summary: koha-worker systemd service should run as %i-koha in package install Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org Frido pointed out that koha-worker will run as root in a package install because we haven't specified a lower privileged Koha-specific user. See https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26363#c32. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |26363 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26363 [Bug 26363] Provide a systemd unit file for background_jobs_worker -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- And I just remembered that we can't securely use systemd in a container, and trying to do so for testing purposes is challenging as well. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=25674 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- Created attachment 117552 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=117552&action=edit Bug 27844: Launch koha-worker systemd service as koha linux user This patch adds the User directive to the koha-worker systemd unit file Test plan: 0a. DO NOT APPLY PATCH YET 0b. Start a Koha testing environment running systemd 1. koha-worker --stop kohadev 2. cp debian/templates/koha-worker@.service /etc/systemd/system/. 3. systemctl start koha-worker@kohadev.service 4. ps -efww | grep "background_jobs_worker" 5. Note koha-worker is running as root 6. APPLY THE PATCH 7. cp debian/templates/koha-worker@.service /etc/systemd/system/. 8. systemctl daemon-reload 9. systemctl restart koha-worker@kohadev.service 10. ps -efww | grep "background_jobs_worker" 11. Note that koha-worker is now running as kohadev-koha -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- Here are some instructions on how to create a koha-testing-docker container with Systemd using Docker: Systemd in container (insecurely): 0. Build an image FROM koha/koha-testing:master 1. Install systemd and systemd-sysv 2. CMD ["/sbin/init"] 3. Update your docker-compose file to use this new systemd image for koha container 4. Update your docker-compose file to use "privileged: true" to the koha container 5. Enter into the koha container and run /kohadevbox/run.sh by hand 6. systemctl daemon-reload 7. service koha-common stop 8. service koha-common start -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- Alternative (more secure) systemd inspired by https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non-privi...: Systemd in container (insecurely): 0. Build an image FROM koha/koha-testing:master 1. Install systemd and systemd-sysv 2. CMD ["/sbin/init"] 3. Update your docker-compose file to use this new systemd image for koha container 4. Update your docker-compose file to have a volume "/sys/fs/cgroup:/sys/fs/cgroup:ro" for the koha container 5. Enter into the koha container and run /kohadevbox/run.sh by hand 6. systemctl daemon-reload 7. service koha-common stop 8. service koha-common start -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Bug 27844 depends on bug 26363, which changed state. Bug 26363 Summary: Provide a systemd unit file for background_jobs_worker https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26363 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Bug 27844 depends on bug 26363, which changed state. Bug 26363 Summary: Provide a systemd unit file for background_jobs_worker https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26363 What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Bug 27844 depends on bug 26363, which changed state. Bug 26363 Summary: Provide a systemd unit file for background_jobs_worker https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26363 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m, | |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #5 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Is this patch ready for testing, David? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #5)
Is this patch ready for testing, David?
I think so. I must've forgotten to mark it as Needs Signoff. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net --- Comment #7 from Victor Grousset/tuxayo <victor@tuxayo.net> --- /kohadevbox/run.sh yields the following error. Note: Writing koha-zebra.8 Running [sudo rm /usr/share/man/man8/koha-*.8.gz]... Running [sudo gzip /usr/share/man/man8/koha-*.8]... See kohadev-db-request.txt for database creation request. Please forward it to the right person, and then run /usr/sbin/koha-create --populate-db kohadev Thanks. Failed to connect to bus: No such file or directory [....] Restarting apache2 (via systemctl): apache2.serviceFailed to connect to bus: No such file or directory failed! ###### /h/d/d/k/koha-testing-docker ❯❯❯ cat Dockerfile-27844 FROM koha/koha-testing:master RUN apt-get update \ && apt-get -y install systemd systemd-sysv CMD ["/sbin/init"] ###### git diff docker-compose.yml koha: - image: koha/koha-testing:${KOHA_IMAGE} + image: container-bug-27844 depends_on: [...] - /home/datumoj/dev/koha/koha-testing-docker/persistent-files/bash_history-koha:/var/lib/koha/kohadev/.bash_history + - /sys/fs/cgroup:/sys/fs/cgroup:ro tmpfs: ##### build command docker build -t container-bug-27844 -f Dockerfile-27844 . -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 --- Comment #8 from David Cook <dcook@prosentient.com.au> --- Bizarre. I'm probably not going to look at this again any time soon, so you might want to try a non-containerized Docker environment. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 --- Comment #9 from Victor Grousset/tuxayo <victor@tuxayo.net> ---
you might want to try a non-containerized Docker environment.
You mean a non-koha-testing-docker env? Still using docker and with manual Koha install. And what about a KohaDevBox? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 --- Comment #10 from David Cook <dcook@prosentient.com.au> --- (In reply to Victor Grousset/tuxayo from comment #9)
you might want to try a non-containerized Docker environment.
You mean a non-koha-testing-docker env? Still using docker and with manual Koha install.
Haha I meant a non-containerized Dev environment. I used the wrong D word.
And what about a KohaDevBox?
Yep that should work. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #117552|0 |1 is obsolete| | --- Comment #11 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 120817 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=120817&action=edit Bug 27844: Launch koha-worker systemd service as koha linux user This patch adds the User directive to the koha-worker systemd unit file Test plan: 0a. DO NOT APPLY PATCH YET 0b. Start a Koha testing environment running systemd 1. koha-worker --stop kohadev 2. cp debian/templates/koha-worker@.service /etc/systemd/system/. 3. systemctl start koha-worker@kohadev.service 4. ps -efww | grep "background_jobs_worker" 5. Note koha-worker is running as root 6. APPLY THE PATCH 7. cp debian/templates/koha-worker@.service /etc/systemd/system/. 8. systemctl daemon-reload 9. systemctl restart koha-worker@kohadev.service 10. ps -efww | grep "background_jobs_worker" 11. Note that koha-worker is now running as kohadev-koha Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #12 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Lol so easy to test with a devbox :D It works! A bit out of topic: Good thing it's still there. If the question of redoing it as wrapper of koha-testing-docker come up, it needs to be kept in mind that such tests won't be as easy due to loosing systemd in the process. Likely not that often needed to be a great weight in the balance. I could have used vagrant for a Debian VM and installed Koha there. Hum, sharing the code with the host might be difficult. And maybe I would have needed this gitify thing. Hum, might be harder than expected. </offtopic> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #120817|0 |1 is obsolete| | --- Comment #13 from Kyle M Hall <kyle@bywatersolutions.com> --- Created attachment 120944 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=120944&action=edit Bug 27844: Launch koha-worker systemd service as koha linux user This patch adds the User directive to the koha-worker systemd unit file Test plan: 0a. DO NOT APPLY PATCH YET 0b. Start a Koha testing environment running systemd 1. koha-worker --stop kohadev 2. cp debian/templates/koha-worker@.service /etc/systemd/system/. 3. systemctl start koha-worker@kohadev.service 4. ps -efww | grep "background_jobs_worker" 5. Note koha-worker is running as root 6. APPLY THE PATCH 7. cp debian/templates/koha-worker@.service /etc/systemd/system/. 8. systemctl daemon-reload 9. systemctl restart koha-worker@kohadev.service 10. ps -efww | grep "background_jobs_worker" 11. Note that koha-worker is now running as kohadev-koha Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Kyle M Hall <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |kyle@bywatersolutions.com |y.org | CC| |kyle@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |21.05.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 --- Comment #14 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Pushed to master for 21.05, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable Version(s)|21.05.00 |21.05.00,20.11.06 released in| | --- Comment #15 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 20.11.x for 20.11.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27844 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |RESOLVED Resolution|--- |FIXED CC| |andrew@bywatersolutions.com --- Comment #16 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Missing dependency, not backported to 20.05.x -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org