Incorrect permissions logic in snap wrapper

Bug #1992713 reported by James Simpson
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
prometheus-snap
Fix Committed
High
James Simpson

Bug Description

On restarting the Prometheus snap, you'll be treated to a lovely spew of "Operation not permitted" errors. For example:

Oct 13 01:22:18 juju-dd628a-stg-is-prometheus-3 prometheus.prometheus[1049870]: chmod: changing permissions of '/var/snap/prometheus/common/tsdb': Operation not permitted
Oct 13 01:22:18 juju-dd628a-stg-is-prometheus-3 prometheus.prometheus[1049871]: chmod: changing permissions of '/var/snap/prometheus/common/tsdb/01GF6ZYKFH7TJN3D3A86BXKWXF': Operation not permitted
Oct 13 01:22:18 juju-dd628a-stg-is-prometheus-3 prometheus.prometheus[1049872]: chmod: changing permissions of '/var/snap/prometheus/common/tsdb/01GF6ZYKFH7TJN3D3A86BXKWXF/chunks': Operation not permitted
Oct 13 01:22:18 juju-dd628a-stg-is-prometheus-3 prometheus.prometheus[1049873]: chmod: changing permissions of '/var/snap/prometheus/common/tsdb/01GF7DP1ZJJDPTDSBTA0B4WJHH': Operation not permitted
Oct 13 01:22:18 juju-dd628a-stg-is-prometheus-3 prometheus.prometheus[1049874]: chmod: changing permissions of '/var/snap/prometheus/common/tsdb/01GF7DP1ZJJDPTDSBTA0B4WJHH/chunks': Operation not permitted
Oct 13 01:22:18 juju-dd628a-stg-is-prometheus-3 prometheus.prometheus[1049875]: chmod: changing permissions of '/var/snap/prometheus/common/tsdb/01GF3ZTE2XAJJ9254VT028KK5W': Operation not permitted
Oct 13 01:22:18 juju-dd628a-stg-is-prometheus-3 prometheus.prometheus[1049876]: chmod: changing permissions of '/var/snap/prometheus/common/tsdb/01GF3ZTE2XAJJ9254VT028KK5W/chunks': Operation not permitted

There are two issues here:

1) We aren't catering for a scenario where we need to modify permissions once ownership is already altered.

2) We're being overzealous with the permissions being applied. The intention was to ensure that moving to a rootless daemon didn't prevent the snap from reading any of its own files, and for that intention to be met there's no need for us to modify permissions within the TSDB.

Related branches

James Simpson (jsimpso)
Changed in prometheus-snap:
status: New → In Progress
assignee: nobody → James Simpson (jsimpso)
importance: Undecided → High
Revision history for this message
James Simpson (jsimpso) wrote :

Fix tested in edge and promoted to candidate

Changed in prometheus-snap:
status: In Progress → Fix Committed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.