bugrdiff-backup - Bugs: bug #27729, Permission denied when renaming...

 
 

bug #27729: Permission denied when renaming rdiff-backup.tmp file

Submitted by:  Kurt <greenmoss>
Submitted on:  Fri 16 Oct 2009 09:10:45 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 04 Nov 2009 07:15:00 PM UTC, comment #2:

So, I noticed something else: rdiff-backup.tmp.9770 in this case points to /etc/ssl/private. This file is not readable by the backup user on my backup machine.

After encounting the same problem on another backup, I ran an strace on it and noticed the following system calls leading up to the error:

22969 lstat("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", 0x7ffff
fae9e70) = -1 ENOENT (No such file or directory)
22969 symlink("/etc/ssl/private/ssl-cert-snakeoil.key", "/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785") = 0
22969 lstat("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", {st_mode=S_IFLNK|0777, st_size=38, ...}) = 0
22969 readlink("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", "/etc/ssl/private/ssl-cert-snakeoil.key", 1023) = 38
22969 listxattr("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", (nil), 0) = -1 EACCES (Permission denied)
22969 write(3, "Warning: listattr(\'/storage/sysb"..., 136) = 136
22969 write(1, "Warning: listattr(\'/storage/sysb"..., 136) = 136
22969 listxattr("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", (nil), 0) = -1 EACCES (Permission denied)

After this, I see system calls that are presumably rdiff-backup exiting with a stack trace:

22969 stat("/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", {st_mode=S_IFREG|0644, st
_size=36069, ...}) = 0
22969 open("/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", O_RDONLY) = 8
22969 fstat(8, {st_mode=S_IFREG|0644, st_size=36069, ...}) = 0
22969 fstat(8, {st_mode=S_IFREG|0644, st_size=36069, ...}) = 0
22969 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaadea20
00
22969 read(8, "# Copyright 2002, 2003, 2004, 20"..., 8192) = 8192

...and so on.

So, what I think is happening is that rdiff-backup on the backup server (not the backup target) is trying to get status on the target of the symlink. On the backup server, rdiff-backup is being invoked by a non-privileged user. Since the symlink target is not readable by the non-privileged user on the backup server, the symlink status fails, and rdiff-backup aborts. Thus, rdiff-backup needs to handle symlinks on the backup server more intelligently.

Thus, the instructions to reproduce this problem must be amended:

- set up an Ubuntu Hardy "server" with rdiff-backup, and install openssl on it (this creates the only-readable-by-root /etc/ssl/private)
- set up an Ubuntu Hardy "client" with rdiff-backup, likewise installing openssl on it
- run rdiff-backup from the server as a non-privileged user, for example user "backup"

If my analysis above is correct, a backup using the above scenario should fail.

Kurt <greenmoss>
Fri 16 Oct 2009 09:30:42 PM UTC, comment #1:

I got a few details wrong. I think I managed to do the "chmod g+r,g+w" on a different client, but it's not working here. I worked around it by deleting the /usr/lib/ssl/private symlink. So maybe it's something to do with symlinks.

If you want to duplicate the problem, set up an Ubuntu Jaunty server (9.04) and install the package "openssl", then back it up using rdiff-backup 1.2.8 on client and server. Make sure you are running your backups on the backup server as non-root! I have reproduced this twice across separate hosts with these conditions.

Kurt <greenmoss>
Fri 16 Oct 2009 09:10:45 PM UTC, original submission:

Original host permissions:

$ sudo ls -la /usr/lib/ssl/private/
total 12
drwxr-x--- 2 root ssl-cert 4096 2009-10-16 08:09 .
drwxr-xr-x 4 root root 4096 2009-10-16 08:10 ..
-rw-r----- 1 root ssl-cert 887 2009-10-16 08:09 ssl-cert-snakeoil.key

Backed-up directory permissions:

$ sudo ls -la /backups/thehost/usr/lib/ssl/
total 24
drwx------ 4 backup backup 4096 2009-10-16 16:38 .
drwx------ 40 backup backup 12288 2009-10-16 16:38 ..
lrwxrwxrwx 1 backup backup 14 2009-10-16 16:05 certs -> /etc/ssl/certs
drwxr-xr-x 2 backup backup 4096 2009-10-16 08:10 engines
drwxr-xr-x 2 backup backup 84 2009-10-16 08:10 misc
lrwxrwxrwx 1 backup backup 20 2009-10-16 16:05 openssl.cnf -> /etc/ssl/openssl.cnf
lrwxrwxrwx 1 backup backup 16 2009-10-16 16:33 rdiff-backup.tmp.9770 -> /etc/ssl/private

Notice that the source on the client (and the backed-up version) is drwxr-x--- 2 backup backup

So user "backup" is given r-x (not rwx), and thus access fails. Once I make /etc/ssl/private on the clinet drwxrwx--- it works.

The stack trace is:

Regular copying ('usr', 'lib', 'ssl', 'private') to /backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771
Warning: listattr('/backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771'): [Errno 13] Permission denied
Copying attributes from ('usr', 'lib', 'ssl', 'private') to /backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771
Exception '[Errno 13] Permission denied' raised of class 'exceptions.IOError':
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 304, in error_check_Main
try: Main(arglist)
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 324, in Main
take_action(rps)
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 280, in take_action
elif action == "backup": Backup(rps[0], rps[1])
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 346, in Backup
backup.Mirror(rpin, rpout)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 38, in Mirror
DestS.patch(dest_rpath, source_diffiter)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 232, in patch
ITR(diff.index, diff)
File "/usr/lib/python2.4/site-packages/rdiff_backup/rorpiter.py", line 281, in _call_
last_branch.fast_process(*args)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 529, in fast_process
if self.patch_to_temp(mirror_rp, diff_rorp, tf):
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 553, in patch_to_temp
result = self.patch_snapshot_to_temp(diff_rorp, new)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 578, in patch_snapshot_to_temp
rpath.copy_attribs(diff_rorp, new)
File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 181, in copy_attribs
if Globals.eas_write: rpout.write_ea(rpin.get_ea())
File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 1347, in write_ea
ea.write_to_rp(self)
File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 111, in write_to_rp
self.clear_rp(rp)
File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 89, in clear_rp
for name in rp.conn.xattr.listxattr(rp.path, rp.issym()):

Traceback (most recent call last):
File "/usr/bin/rdiff-backup", line 30, in ?
rdiff_backup.Main.error_check_Main(sys.argv[1:])
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 304, in error_check_Main
try: Main(arglist)
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 324, in Main
take_action(rps)
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 280, in take_action
elif action == "backup": Backup(rps[0], rps[1])
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 346, in Backup
backup.Mirror(rpin, rpout)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 38, in Mirror
DestS.patch(dest_rpath, source_diffiter)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 232, in patch
ITR(diff.index, diff)
File "/usr/lib/python2.4/site-packages/rdiff_backup/rorpiter.py", line 281, in _call_
last_branch.fast_process(*args)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 529, in fast_process
if self.patch_to_temp(mirror_rp, diff_rorp, tf):
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 553, in patch_to_temp
result = self.patch_snapshot_to_temp(diff_rorp, new)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 578, in patch_snapshot_to_temp
rpath.copy_attribs(diff_rorp, new)
File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 181, in copy_attribs
if Globals.eas_write: rpout.write_ea(rpin.get_ea())
File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 1347, in write_ea
ea.write_to_rp(self)
File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 111, in write_to_rp
self.clear_rp(rp)
File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 89, in clear_rp
for name in rp.conn.xattr.listxattr(rp.path, rp.issym()):
IOError: [Errno 13] Permission denied

Kurt <greenmoss>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by greenmoss (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup1