[rrdtool-maint] Bug#890286: rrdcached: "gmetad RRD_update [...] rrdcached: Permission denied" if limited socket specified first

[Chad W Seys]

Package: rrdcached
Version: 1.6.0-1+b2
Severity: normal

Hi,
  This is probably an upstream bug, with a workaround in Stretch.
  Upon upgrading from Jessie to Stretch ganglia gmetad could no longer use rrdcached to
write rrds .
  Here's an example line from /var/log/messages:
gangle /usr/sbin/gmetad[3554]: RRD_update (/var/lib/ganglia/rrds/GLOW-CMS/s17n08.hep.wisc.edu/cpu_speed.rrd): rrdcached: Permission denied.

  After fiddling with permissions on the socket, file, etc I found that changing the command line order
of the sockets works around the problem.  It appears as though the limited socket needs to be specified
first.  

# WORKS:
/usr/bin/rrdcached -w 3600 -f 7200 -j /var/lib/rrdcached/journal/ \
-s ganglia -m 664 -l unix:/var/run/rrdcached.sock \
-s www-data -m 777 -P FLUSH,STATS,HELP,FETCH -l unix:/var/run/rrdcached.limited.sock \
-b /var/lib/ganglia/rrds -B -p /var/run/rrdcached.pid

# DOES NOT WORK:
/usr/bin/rrdcached -w 3600 -f 7200 -j /var/lib/rrdcached/journal/ \
-s www-data -m 777 -P FLUSH,STATS,HELP,FETCH -l unix:/var/run/rrdcached.limited.sock \
-s ganglia -m 664 -l unix:/var/run/rrdcached.sock \
-b /var/lib/ganglia/rrds -B -p /var/run/rrdcached.pid

  Since -P flags in the limited socket can only be added to /etc/defaults/rrdcache BASE_OPTIONS,
the way to work around this in Stretch is to place BASE_OPTIONS in /etc/init.d/rrdcached after
the socket options like this:

RRDCACHED_OPTIONS="\
  # former location of $BASE_OPTIONS
  ${NETWORK_OPTIONS} \
  ${WRITE_TIMEOUT:+-w ${WRITE_TIMEOUT}} \
  ${WRITE_JITTER:+-z ${WRITE_JITTER}} \
  ${WRITE_THREADS:+-t ${WRITE_THREADS}} \
  ${BASE_PATH:+-b ${BASE_PATH}} \
  ${JOURNAL_PATH:+-j ${JOURNAL_PATH}} \
  ${DAEMON_GROUP:+-G ${DAEMON_GROUP}} \
  ${DAEMON_USER:+-U ${DAEMON_USER}} \
  -p ${PIDFILE} \
  ${SOCKFILE:+${SOCKGROUP:+-s ${SOCKGROUP}} ${SOCKMODE:+-m ${SOCKMODE}} -l unix:${SOCKFILE}} \
  ${BASE_OPTIONS}
    "

(Also notice addition of FETCH on limited socket. Without this ganglia-web cannot draw all the graphs.)

Thanks!
C.


-- System Information:
Debian Release: 9.3
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-5-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages rrdcached depends on:
ii  libc6                2.24-11+deb9u1
ii  libcairo2            1.14.8-1
ii  libdbi1              0.9.0-4+deb9u1
ii  libglib2.0-0         2.50.3-2
ii  libpango-1.0-0       1.40.5-1
ii  libpangocairo-1.0-0  1.40.5-1
ii  libpng16-16          1.6.28-1
ii  librrd8              1.7.0-1
ii  libxml2              2.9.4+dfsg1-2.2+deb9u2

rrdcached recommends no packages.

rrdcached suggests no packages.

-- Configuration Files:
/etc/default/rrdcached changed:
BASE_OPTIONS="-f 7200 -s www-data -m 777 -P FLUSH,STATS,HELP,FETCH -l unix:/var/run/rrdcached.limited.sock"

-- no debconf information