Wed 04 Nov 2009 07:15:00 PM UTC, comment #2:
So, I noticed something else: rdiff-backup.tmp.9770 in this case points to /etc/ssl/private. This file is not readable by the backup user on my backup machine.
After encounting the same problem on another backup, I ran an strace on it and noticed the following system calls leading up to the error:
22969 lstat("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", 0x7ffff
fae9e70) = -1 ENOENT (No such file or directory)
22969 symlink("/etc/ssl/private/ssl-cert-snakeoil.key", "/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785") = 0
22969 lstat("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", {st_mode=S_IFLNK|0777, st_size=38, ...}) = 0
22969 readlink("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", "/etc/ssl/private/ssl-cert-snakeoil.key", 1023) = 38
22969 listxattr("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", (nil), 0) = -1 EACCES (Permission denied)
22969 write(3, "Warning: listattr(\'/storage/sysb"..., 136) = 136
22969 write(1, "Warning: listattr(\'/storage/sysb"..., 136) = 136
22969 listxattr("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", (nil), 0) = -1 EACCES (Permission denied)
After this, I see system calls that are presumably rdiff-backup exiting with a stack trace:
22969 stat("/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", {st_mode=S_IFREG|0644, st
_size=36069, ...}) = 0
22969 open("/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", O_RDONLY) = 8
22969 fstat(8, {st_mode=S_IFREG|0644, st_size=36069, ...}) = 0
22969 fstat(8, {st_mode=S_IFREG|0644, st_size=36069, ...}) = 0
22969 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaadea20
00
22969 read(8, "# Copyright 2002, 2003, 2004, 20"..., 8192) = 8192
...and so on.
So, what I think is happening is that rdiff-backup on the backup server (not the backup target) is trying to get status on the target of the symlink. On the backup server, rdiff-backup is being invoked by a non-privileged user. Since the symlink target is not readable by the non-privileged user on the backup server, the symlink status fails, and rdiff-backup aborts. Thus, rdiff-backup needs to handle symlinks on the backup server more intelligently.
Thus, the instructions to reproduce this problem must be amended:
- set up an Ubuntu Hardy "server" with rdiff-backup, and install openssl on it (this creates the only-readable-by-root /etc/ssl/private)
- set up an Ubuntu Hardy "client" with rdiff-backup, likewise installing openssl on it
- run rdiff-backup from the server as a non-privileged user, for example user "backup"
If my analysis above is correct, a backup using the above scenario should fail.
|
Fri 16 Oct 2009 09:10:45 PM UTC, original submission:
Original host permissions:
$ sudo ls -la /usr/lib/ssl/private/
total 12
drwxr-x--- 2 root ssl-cert 4096 2009-10-16 08:09 .
drwxr-xr-x 4 root root 4096 2009-10-16 08:10 ..
-rw-r----- 1 root ssl-cert 887 2009-10-16 08:09 ssl-cert-snakeoil.key
Backed-up directory permissions:
$ sudo ls -la /backups/thehost/usr/lib/ssl/
total 24
drwx------ 4 backup backup 4096 2009-10-16 16:38 .
drwx------ 40 backup backup 12288 2009-10-16 16:38 ..
lrwxrwxrwx 1 backup backup 14 2009-10-16 16:05 certs -> /etc/ssl/certs
drwxr-xr-x 2 backup backup 4096 2009-10-16 08:10 engines
drwxr-xr-x 2 backup backup 84 2009-10-16 08:10 misc
lrwxrwxrwx 1 backup backup 20 2009-10-16 16:05 openssl.cnf -> /etc/ssl/openssl.cnf
lrwxrwxrwx 1 backup backup 16 2009-10-16 16:33 rdiff-backup.tmp.9770 -> /etc/ssl/private
Notice that the source on the client (and the backed-up version) is drwxr-x--- 2 backup backup
So user "backup" is given r-x (not rwx), and thus access fails. Once I make /etc/ssl/private on the clinet drwxrwx--- it works.
The stack trace is:
Regular copying ('usr', 'lib', 'ssl', 'private') to /backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771
Warning: listattr('/backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771'): [Errno 13] Permission denied
Copying attributes from ('usr', 'lib', 'ssl', 'private') to /backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771
Exception '[Errno 13] Permission denied' raised of class 'exceptions.IOError':
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 304, in error_check_Main
try: Main(arglist)
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 324, in Main
take_action(rps)
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 280, in take_action
elif action == "backup": Backup(rps[0], rps[1])
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 346, in Backup
backup.Mirror(rpin, rpout)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 38, in Mirror
DestS.patch(dest_rpath, source_diffiter)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 232, in patch
ITR(diff.index, diff)
File "/usr/lib/python2.4/site-packages/rdiff_backup/rorpiter.py", line 281, in _call_
last_branch.fast_process(*args)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 529, in fast_process
if self.patch_to_temp(mirror_rp, diff_rorp, tf):
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 553, in patch_to_temp
result = self.patch_snapshot_to_temp(diff_rorp, new)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 578, in patch_snapshot_to_temp
rpath.copy_attribs(diff_rorp, new)
File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 181, in copy_attribs
if Globals.eas_write: rpout.write_ea(rpin.get_ea())
File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 1347, in write_ea
ea.write_to_rp(self)
File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 111, in write_to_rp
self.clear_rp(rp)
File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 89, in clear_rp
for name in rp.conn.xattr.listxattr(rp.path, rp.issym()):
Traceback (most recent call last):
File "/usr/bin/rdiff-backup", line 30, in ?
rdiff_backup.Main.error_check_Main(sys.argv[1:])
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 304, in error_check_Main
try: Main(arglist)
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 324, in Main
take_action(rps)
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 280, in take_action
elif action == "backup": Backup(rps[0], rps[1])
File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 346, in Backup
backup.Mirror(rpin, rpout)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 38, in Mirror
DestS.patch(dest_rpath, source_diffiter)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 232, in patch
ITR(diff.index, diff)
File "/usr/lib/python2.4/site-packages/rdiff_backup/rorpiter.py", line 281, in _call_
last_branch.fast_process(*args)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 529, in fast_process
if self.patch_to_temp(mirror_rp, diff_rorp, tf):
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 553, in patch_to_temp
result = self.patch_snapshot_to_temp(diff_rorp, new)
File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 578, in patch_snapshot_to_temp
rpath.copy_attribs(diff_rorp, new)
File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 181, in copy_attribs
if Globals.eas_write: rpout.write_ea(rpin.get_ea())
File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 1347, in write_ea
ea.write_to_rp(self)
File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 111, in write_to_rp
self.clear_rp(rp)
File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 89, in clear_rp
for name in rp.conn.xattr.listxattr(rp.path, rp.issym()):
IOError: [Errno 13] Permission denied
|