8000 Give all users read/write permissions for snapshots directory by caffeinatedpixel · Pull Request #81 · activecm/BeaKer · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Give all users read/write permissions for snapshots directory #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
May 2, 2023
Merged

Give all users read/write permissions for snapshots directory #81

merged 3 commits into from
May 2, 2023

Conversation

caffeinatedpixel
Copy link
Contributor

Closes #80

In order to resolve the missing permissions on the snapshots directory for some BeaKer installs, the directory is given read/write permissions for all users. This shouldn't be an issue since the /opt/BeaKer directory requires admin/sudo access.

Testing:

I tried to replicate the issue on Ubuntu 20.04 with a fresh v0.0.13 BeaKer install and applying the current installer over it for ELK v7.17.9 and v8.7.0. I did not run into the failing snapshot creation during the upgrade. After the upgrade completed, manually created a snapshot via the snapshot API and was able to do so. I exec'd into the elasticsearch container and noted that the owner of the snapshots directory was elasticsearch:root, and was able to write to that directory via echo "test" > test. The /opt/BeaKer/snapshots folder was owned by naomi:root. Creating a file in /opt/BeaKer/snapshots created a file in /usr/share/elasticsearch/snapshots within the container. After running beaker down and beaker up -d, the permissions stayed the same.
I repeated the steps on CentOS 7 ( selinux mode permissive) with the same results.

I tested this PR using the same steps listed above on Ubuntu 20.04. Since the folder ownership change was removed, the owner is now root:root for both /opt/BeaKer/snapshots and /usr/share/elasticsearch/snapshots on the container. In my case, snapshot creation continues to succeed.

@Zalgo2462 Zalgo2462 self-requested a review May 2, 2023 18:01
@Zalgo2462
Copy link
Contributor

I built this installer and tried to install it on my Ubuntu 20 machine which has the issue.

I'm not able to make a snapshot but it appears the error may be different at first glance:
image

Running the snapshot repo creation command again yields the same 500 error message:
image

The elasticsearch logs have the same errors:
org.elasticsearch.repositories.RepositoryVerificationException: [beaker] path is not accessible on master node
Caused by: java.nio.file.NoSuchFileException: /usr/share/elasticsearch/snapshots/tests-7TLlg7t1QP6UC6KVtjd_Ww

A few things I noticed:

The script attempts to restart beaker even though it is already running.
The following line should use a dash or wildcard between beaker and elasticsearch:

BeaKer/installer/stage/BeaKer/install_beaker.sh

Line 294 in c2efade

if [ `$SUDO docker ps | grep 'beaker_elasticsearch' | wc -l` -eq 0 ]; then

My docker ps output:
image

We don't mark the host directory 777 at https://github.com/activecm/BeaKer/blob/master/installer/stage/BeaKer/install_beaker.sh#L181 . I'll try adding a chmod to this line here and giving it another run.

@Zalgo2462
Copy link
Contributor

I'm going to run a test with the following changes:
image

Let me know if you have any other ideas.

@Zalgo2462
Copy link
Contributor

The changes in the diff above added to this PR worked to get this machine to take a snapshot.
@caffeinatedpixel do those changes look good to you?

@caffeinatedpixel
Copy link
Contributor Author

@Zalgo2462 Looks good, pushed

@Zalgo2462
Copy link
Contributor

@caffeinatedpixel The chmod line in ensure_snapshot_repo_exists needs to be added as well.

@caffeinatedpixel
Copy link
Contributor Author

@Zalgo2462 My bad, added as well

Zalgo2462
Zalgo2462 approved these changes May 2, 2023
View reviewed changes
Copy link
Contributor
@Zalgo2462 Zalgo2462 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested well

@Zalgo2462 Zalgo2462 merged commit ab940ab into master May 2, 2023
@Zalgo2462 Zalgo2462 deleted the 80-snapshot-perms branch May 2, 2023 18:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Zalgo2462 Zalgo2462 Zalgo2462 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Snapshot directory doesn't always have required permissions
2 participants
@caffeinatedpixel @Zalgo2462
0