<div dir="ltr"><div>Hello,</div><div><br></div><div>This bug report is about bookworm (stable) version, so the fact that it has been fixed in unstable is nice, but should not resolve this.</div><div>Since it's about a real regression, I think this fix should be eligible for a backport don't you think?</div><div><br></div><div>Thanks.<br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Oct 11, 2023 at 12:21 AM Debian Bug Tracking System <<a href="mailto:owner@bugs.debian.org">owner@bugs.debian.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">This is an automatic notification regarding your Bug report<br>
which was filed against the crmsh package:<br>
<br>
#1042448: crmsh: HA_GROUP permission regression after upgrading bullseye to bookworm<br>
<br>
It has been closed by Debian FTP Masters <<a href="mailto:ftpmaster@ftp-master.debian.org" target="_blank">ftpmaster@ftp-master.debian.org</a>> (reply to Valentin Vidic <<a href="mailto:vvidic@debian.org" target="_blank">vvidic@debian.org</a>>).<br>
<br>
Their explanation is attached below along with your original report.<br>
If this explanation is unsatisfactory and you have not received a<br>
better one in a separate message then please contact Debian FTP Masters <<a href="mailto:ftpmaster@ftp-master.debian.org" target="_blank">ftpmaster@ftp-master.debian.org</a>> (reply to Valentin Vidic <<a href="mailto:vvidic@debian.org" target="_blank">vvidic@debian.org</a>>) by<br>
replying to this email.<br>
<br>
<br>
-- <br>
1042448: <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1042448" rel="noreferrer" target="_blank">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1042448</a><br>
Debian Bug Tracking System<br>
Contact <a href="mailto:owner@bugs.debian.org" target="_blank">owner@bugs.debian.org</a> with problems<br>
<br><br><br>---------- Forwarded message ----------<br>From: Debian FTP Masters <<a href="mailto:ftpmaster@ftp-master.debian.org" target="_blank">ftpmaster@ftp-master.debian.org</a>><br>To: <a href="mailto:1042448-close@bugs.debian.org" target="_blank">1042448-close@bugs.debian.org</a><br>Cc: <br>Bcc: <br>Date: Tue, 10 Oct 2023 22:19:34 +0000<br>Subject: Bug#1042448: fixed in crmsh 4.5.0-1<br>Source: crmsh<br>
Source-Version: 4.5.0-1<br>
Done: Valentin Vidic <<a href="mailto:vvidic@debian.org" target="_blank">vvidic@debian.org</a>><br>
<br>
We believe that the bug you reported is fixed in the latest version of<br>
crmsh, which is due to be installed in the Debian FTP archive.<br>
<br>
A summary of the changes between this version and the previous one is<br>
attached.<br>
<br>
Thank you for reporting the bug, which will now be closed. If you<br>
have further comments please address them to <a href="mailto:1042448@bugs.debian.org" target="_blank">1042448@bugs.debian.org</a>,<br>
and the maintainer will reopen the bug report if appropriate.<br>
<br>
Debian distribution maintenance software<br>
pp.<br>
Valentin Vidic <<a href="mailto:vvidic@debian.org" target="_blank">vvidic@debian.org</a>> (supplier of updated crmsh package)<br>
<br>
(This message was generated automatically at their request; if you<br>
believe that there is a problem with it please contact the archive<br>
administrators by mailing <a href="mailto:ftpmaster@ftp-master.debian.org" target="_blank">ftpmaster@ftp-master.debian.org</a>)<br>
<br>
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA512<br>
<br>
Format: 1.8<br>
Date: Tue, 10 Oct 2023 22:57:14 +0200<br>
Source: crmsh<br>
Architecture: source<br>
Version: 4.5.0-1<br>
Distribution: unstable<br>
Urgency: medium<br>
Maintainer: Debian HA Maintainers <<a href="mailto:debian-ha-maintainers@lists.alioth.debian.org" target="_blank">debian-ha-maintainers@lists.alioth.debian.org</a>><br>
Changed-By: Valentin Vidic <<a href="mailto:vvidic@debian.org" target="_blank">vvidic@debian.org</a>><br>
Closes: 1042448 1044302<br>
Changes:<br>
crmsh (4.5.0-1) unstable; urgency=medium<br>
.<br>
* New upstream version 4.5.0<br>
* d/patches: refresh for new version<br>
* d/tests: refresh for new version<br>
* d/postinst: create a logging directory (Closes: #1042448)<br>
* d/clean: remove generated files (Closes: #1044302)<br>
* d/patches: add fix for ssh error<br>
Checksums-Sha1:<br>
23a937b6ba05f7af5df655d919504d0fbdb9006a 2337 crmsh_4.5.0-1.dsc<br>
8d0459c4be7346179236be43e009d8eadf37e988 1210069 crmsh_4.5.0.orig.tar.gz<br>
f1040bde2b0bcfdd008e013b9c67562e480c696f 30856 crmsh_4.5.0-1.debian.tar.xz<br>
1d7ab5a0e5c9f597468e2bde5075b6426f0f3bdf 6984 crmsh_4.5.0-1_source.buildinfo<br>
Checksums-Sha256:<br>
f7abb8c2ec6ca07af26b1d112c2a5d871ca3e5db45a742769a0037aae3d46444 2337 crmsh_4.5.0-1.dsc<br>
18fbed93d5cee530baabfba9e15c6d1f87465506515c8b7e660a1427fdf5801b 1210069 crmsh_4.5.0.orig.tar.gz<br>
f8e974329a682764b51fb34f1db75d8e7ecaab420453cdc92d33427fd0b16014 30856 crmsh_4.5.0-1.debian.tar.xz<br>
1093dae09b6544a708fd4c0f3faf093e370e33f71f67ed4e216f6a0c5403d00c 6984 crmsh_4.5.0-1_source.buildinfo<br>
Files:<br>
0256301652adfb4a56c0fb8a7cab4952 2337 admin optional crmsh_4.5.0-1.dsc<br>
95c363ec7f7e8e6ffd244ddecbaff125 1210069 admin optional crmsh_4.5.0.orig.tar.gz<br>
2e0663d6fdff1cfd53448436d344f244 30856 admin optional crmsh_4.5.0-1.debian.tar.xz<br>
1b9d541cfb38c511931686392d771f7c 6984 admin optional crmsh_4.5.0-1_source.buildinfo<br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
<br>
iQJGBAEBCgAwFiEExaW53cM9k/u2PWfIMofYmpfNqHsFAmUlyigSHHZ2aWRpY0Bk<br>
ZWJpYW4ub3JnAAoJEDKH2JqXzah7WugQAKVp8TCeDRjGEpnBmJgQfVqbE9YG0DKD<br>
k3Zmok3oJziZvAsmOJgFHIOKqihYZ9LdiEGMoTTSMkMch0zujpJW64BtksXmhruV<br>
EvgsbnQjZYikG13Py9hCb84nnKcAer+TSU5fIWRDpE0mzVk7HuqJxc01+82iWDIX<br>
mel82k7emDqh27NAXcEQ7zMaTSuSMYD3CoBvT1nyFSRSripSvkKOd5/elFDtNKYV<br>
tQx9j/JPlRGJrzuwkE3b65JP2cXQvsUG6M8mDgn48Pk7TtcVnhLMlWiVa3N/2yjJ<br>
V7XNx5/x771htaMKbNpN4mxZ2s7QYrs7OzS2TEB5gLz/PVS3DqpULBspQyZr+iDx<br>
qy8ThUKWSde9+j0uS02jTr/B090wCSnCGttiSV12CWY/yddIZjQRix0Hhqiphlts<br>
rV1SUbVuJZsR9VBfe+FYhmXrKWoOlPzyG9a4429nzEf5t/8dEzyy80M9yOfpKm61<br>
5JBE9iMISWC/BpQyTvuOZydN4jayBXxyzslQnGjynbXUOXdjnva2VtEiUTdOZThG<br>
eo9orPWf51xaV9Cn35mutzCEjPYdK9EmDA4DY/OFmZTcysH/x659c4TOgS6qmms2<br>
WgKpHT83pmCCWnRrDhBYOM+ya0rq766j2C9VHuajmie4ISGnmv3O95Lq1aRzyO7a<br>
vYrmJiAEhnDx<br>
=GeLF<br>
-----END PGP SIGNATURE-----<br><br><br>---------- Forwarded message ----------<br>From: Florent CARLI <<a href="mailto:fcarli@gmail.com" target="_blank">fcarli@gmail.com</a>><br>To: Debian Bug Tracking System <<a href="mailto:submit@bugs.debian.org" target="_blank">submit@bugs.debian.org</a>><br>Cc: <br>Bcc: <br>Date: Fri, 28 Jul 2023 10:11:48 +0000<br>Subject: crmsh: HA_GROUP permission regression after upgrading bullseye to bookworm<br>Package: crmsh<br>
Version: 4.4.1-1<br>
Severity: normal<br>
X-Debbugs-Cc: <a href="mailto:fcarli@gmail.com" target="_blank">fcarli@gmail.com</a><br>
<br>
Dear Maintainer,<br>
<br>
I encounter a regression with crmsh on debian12. On debian 11, I used<br>
to be able to issue crm commands with a standard user as long as it<br>
was a member of haclient group.<br>
On debian 12, this same user cannot use crm because of some chown that<br>
it's not allowed to do:<br>
<br>
virtu@virtu-elabo1:~$ id<br>
uid=1000(virtu) gid=1000(virtu) groups=1000(virtu),110(haclient),118(libvirt)<br>
virtu@virtu-elabo1:~$ crm status<br>
Traceback (most recent call last):<br>
File "/usr/sbin/crm", line 31, in <module><br>
log.setup_logging()<br>
File "/usr/lib/python3/dist-packages/crmsh/log.py", line 445, in setup_logging<br>
shutil.chown(CRMSH_LOG_FILE, constants.HA_USER, constants.HA_GROUP)<br>
File "/usr/lib/python3.11/shutil.py", line 1385, in chown<br>
os.chown(path, _user, _group)<br>
PermissionError: [Errno 1] Operation not permitted: '/var/log/crmsh/crmsh.log'<br>
<br>
<br>
Ferenc Wágner did a first analysis and concluded that:<br>
<br>
it's a bug introduced in 4.4.0 by<br>
Fix: log: Change the log file owner as hacluster:haclient (bsc#1194619)<br>
<a href="https://github.com/ClusterLabs/crmsh/commit/b4ef13cd8c9a8c37f2bf671abb803b24d93125ee" rel="noreferrer" target="_blank">https://github.com/ClusterLabs/crmsh/commit/b4ef13cd8c9a8c37f2bf671abb803b24d93125ee</a><br>
<br>
and fixed in 4.5.0 by<br>
fix: log: fail to open log file even if user is in haclient group (bsc#1204670)<br>
<a href="https://github.com/ClusterLabs/crmsh/commit/b4abe21d2fd55ced0f56baff5c4892a4826aa0f7" rel="noreferrer" target="_blank">https://github.com/ClusterLabs/crmsh/commit/b4abe21d2fd55ced0f56baff5c4892a4826aa0f7</a><br>
<br>
<br>
Thanks.<br>
Florent.<br>
<br>
<br>
-- System Information:<br>
Debian Release: 12.1<br>
APT prefers stable-updates<br>
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')<br>
Architecture: arm64 (aarch64)<br>
<br>
Kernel: Linux 5.15.49-linuxkit-pr (SMP w/5 CPU threads; PREEMPT)<br>
Kernel taint flags: TAINT_OOT_MODULE, TAINT_RANDSTRUCT<br>
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set<br>
Shell: /bin/sh linked to /usr/bin/dash<br>
Init: unable to detect<br>
<br>
Versions of packages crmsh depends on:<br>
ii gawk 1:5.2.1-2<br>
ii iputils-ping 3:20221126-1<br>
ii pacemaker-cli-utils 2.1.5-1+deb12u1<br>
ii python3 3.11.2-1+b1<br>
ii python3-dateutil 2.8.2-2<br>
ii python3-lxml 4.9.2-1+b1<br>
ii python3-parallax 1.0.6-4<br>
ii python3-yaml 6.0-3+b2<br>
<br>
Versions of packages crmsh recommends:<br>
ii pacemaker 2.1.5-1+deb12u1<br>
<br>
Versions of packages crmsh suggests:<br>
pn bash-completion <none><br>
pn csync2 <none><br>
pn dmidecode <none><br>
pn ocfs2-tools <none><br>
pn openssh-server <none><br>
pn parted <none><br>
pn sbd <none><br>
pn ufw <none><br>
ii util-linux 2.38.1-5+b1<br>
pn vim-addon-manager <none><br>
<br>
-- no debconf information<br>
</blockquote></div>