bugrdiff-backup - Bugs: bug #27729, Permission denied when renaming...

 
 

bug #27729: Permission denied when renaming rdiff-backup.tmp file

Submitter:  Kurt <greenmoss>
Submitted:  Fri 16 Oct 2009 09:10:45 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 20 May 2022 05:23:43 PM UTC, comment #3: 

This issue has been closed because it hasn&#039;t been touched for years, as the development continued on GitHub. If the issue is still present in a recent version, please re-open it under https://github.com/rdiff-backup/rdiff-backup/issues after having made that it&#039;s not already reported there.

Eric L. <ericzolf>
Group administrator
Wed 04 Nov 2009 07:15:00 PM UTC, comment #2: 

So, I noticed something else: rdiff-backup.tmp.9770 in this case points to /etc/ssl/private. This file is not readable by the backup user on my backup machine.

After encounting the same problem on another backup, I ran an strace on it and noticed the following system calls leading up to the error:

22969 lstat("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", 0x7ffff
fae9e70) = -1 ENOENT (No such file or directory)
22969 symlink("/etc/ssl/private/ssl-cert-snakeoil.key", "/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785") = 0
22969 lstat("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", {st_mode=S_IFLNK|0777, st_size=38, ...}) = 0
22969 readlink("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", "/etc/ssl/private/ssl-cert-snakeoil.key", 1023) = 38
22969 listxattr("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", (nil), 0) = -1 EACCES (Permission denied)
22969 write(3, "Warning: listattr(\'/storage/sysb"..., 136) = 136
22969 write(1, "Warning: listattr(\'/storage/sysb"..., 136) = 136
22969 listxattr("/backups/anotherhost/var/lib/postgresql/8.3/main/rdiff-backup.tmp.5785", (nil), 0) = -1 EACCES (Permission denied)

After this, I see system calls that are presumably rdiff-backup exiting with a stack trace:

22969 stat("/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", {st_mode=S_IFREG|0644, st
_size=36069, ...}) = 0
22969 open("/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", O_RDONLY) = 8
22969 fstat(8, {st_mode=S_IFREG|0644, st_size=36069, ...}) = 0
22969 fstat(8, {st_mode=S_IFREG|0644, st_size=36069, ...}) = 0
22969 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaadea20
00
22969 read(8, "# Copyright 2002, 2003, 2004, 20"..., 8192) = 8192

...and so on.


So, what I think is happening is that rdiff-backup on the backup server (not the backup target) is trying to get status on the target of the symlink. On the backup server, rdiff-backup is being invoked by a non-privileged user. Since the symlink target is not readable by the non-privileged user on the backup server, the symlink status fails, and rdiff-backup aborts. Thus, rdiff-backup needs to handle symlinks on the backup server more intelligently.

Thus, the instructions to reproduce this problem must be amended:

- set up an Ubuntu Hardy "server" with rdiff-backup, and install openssl on it (this creates the only-readable-by-root /etc/ssl/private)
- set up an Ubuntu Hardy "client" with rdiff-backup, likewise installing openssl on it
- run rdiff-backup from the server as a non-privileged user, for example user "backup"

If my analysis above is correct, a backup using the above scenario should fail.

Kurt <greenmoss>
Fri 16 Oct 2009 09:30:42 PM UTC, comment #1: 

I got a few details wrong. I think I managed to do the "chmod g+r,g+w" on a different client, but it's not working here. I worked around it by deleting the /usr/lib/ssl/private symlink. So maybe it's something to do with symlinks.

If you want to duplicate the problem, set up an Ubuntu Jaunty server (9.04) and install the package "openssl", then back it up using rdiff-backup 1.2.8 on client and server. Make sure you are running your backups on the backup server as non-root! I have reproduced this twice across separate hosts with these conditions.

Kurt <greenmoss>
Fri 16 Oct 2009 09:10:45 PM UTC, original submission:  

Original host permissions:

$ sudo ls -la /usr/lib/ssl/private/
total 12
drwxr-x--- 2 root ssl-cert 4096 2009-10-16 08:09 .
drwxr-xr-x 4 root root     4096 2009-10-16 08:10 ..
-rw-r----- 1 root ssl-cert  887 2009-10-16 08:09 ssl-cert-snakeoil.key


Backed-up directory permissions:

$ sudo ls -la /backups/thehost/usr/lib/ssl/
total 24
drwx------  4 backup backup  4096 2009-10-16 16:38 .
drwx------ 40 backup backup 12288 2009-10-16 16:38 ..
lrwxrwxrwx  1 backup backup    14 2009-10-16 16:05 certs -> /etc/ssl/certs
drwxr-xr-x  2 backup backup  4096 2009-10-16 08:10 engines
drwxr-xr-x  2 backup backup    84 2009-10-16 08:10 misc
lrwxrwxrwx  1 backup backup    20 2009-10-16 16:05 openssl.cnf -> /etc/ssl/openssl.cnf
lrwxrwxrwx  1 backup backup    16 2009-10-16 16:33 rdiff-backup.tmp.9770 -> /etc/ssl/private


Notice that the source on the client (and the backed-up version) is drwxr-x--- 2 backup backup

So user "backup" is given r-x (not rwx), and thus access fails. Once I make /etc/ssl/private on the clinet drwxrwx--- it works.



The stack trace is:

Regular copying ('usr', 'lib', 'ssl', 'private') to /backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771
Warning: listattr('/backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771'): [Errno 13] Permission denied
Copying attributes from ('usr', 'lib', 'ssl', 'private') to /backups/thehost/usr/lib/ssl/rdiff-backup.tmp.9771
Exception '[Errno 13] Permission denied' raised of class 'exceptions.IOError':
  File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 304, in error_check_Main
    try: Main(arglist)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 324, in Main
    take_action(rps)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 280, in take_action
    elif action == "backup": Backup(rps[0], rps[1])
  File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 346, in Backup
    backup.Mirror(rpin, rpout)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 38, in Mirror
    DestS.patch(dest_rpath, source_diffiter)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 232, in patch
    ITR(diff.index, diff)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/rorpiter.py", line 281, in _call_
    last_branch.fast_process(*args)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 529, in fast_process
    if self.patch_to_temp(mirror_rp, diff_rorp, tf):
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 553, in patch_to_temp
    result = self.patch_snapshot_to_temp(diff_rorp, new)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 578, in patch_snapshot_to_temp
    rpath.copy_attribs(diff_rorp, new)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 181, in copy_attribs
    if Globals.eas_write: rpout.write_ea(rpin.get_ea())
  File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 1347, in write_ea
    ea.write_to_rp(self)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 111, in write_to_rp
    self.clear_rp(rp)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 89, in clear_rp
    for name in rp.conn.xattr.listxattr(rp.path, rp.issym()):

Traceback (most recent call last):
  File "/usr/bin/rdiff-backup", line 30, in ?
    rdiff_backup.Main.error_check_Main(sys.argv[1:])
  File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 304, in error_check_Main
    try: Main(arglist)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 324, in Main
    take_action(rps)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 280, in take_action
    elif action == "backup": Backup(rps[0], rps[1])
  File "/usr/lib/python2.4/site-packages/rdiff_backup/Main.py", line 346, in Backup
    backup.Mirror(rpin, rpout)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 38, in Mirror
    DestS.patch(dest_rpath, source_diffiter)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 232, in patch
    ITR(diff.index, diff)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/rorpiter.py", line 281, in _call_
    last_branch.fast_process(*args)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 529, in fast_process
    if self.patch_to_temp(mirror_rp, diff_rorp, tf):
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 553, in patch_to_temp
    result = self.patch_snapshot_to_temp(diff_rorp, new)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/backup.py", line 578, in patch_snapshot_to_temp
    rpath.copy_attribs(diff_rorp, new)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 181, in copy_attribs
    if Globals.eas_write: rpout.write_ea(rpin.get_ea())
  File "/usr/lib/python2.4/site-packages/rdiff_backup/rpath.py", line 1347, in write_ea
    ea.write_to_rp(self)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 111, in write_to_rp
    self.clear_rp(rp)
  File "/usr/lib/python2.4/site-packages/rdiff_backup/eas_acls.py", line 89, in clear_rp
    for name in rp.conn.xattr.listxattr(rp.path, rp.issym()):
IOError: [Errno 13] Permission denied

Kurt <greenmoss>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ericzolf (Posted a comment)
  • -email is unavailable- added by greenmoss (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-05-20 ericzolf Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code