Merge lp:~thumper/juju-core/all-machines-trusty into lp:~go-bot/juju-core/trunk

[Tim Penhey]

Fix the local provider all-machines.log

There were a number of problems with this as it was, which failed more in trusty as I think the apparmor profile for rsyslogd may have changed or got bugs fixed.

The rsyslog config file was being written by root with 0600 perms. The rsyslog process does a setuid to become the syslog user. The syslog user couldn't read the config file. Now this is written with 0644 so it can be read.

The apparmor profile is quite strict about where rsyslog can write files. Instead of poking with the profile, the local provider now logs to /var/log/juju-{{user}}-{{env name}}/all-machines.log, and a symlink is made in the local provider log dir to point to that file. The file is also created with 0644 so the user can read it without poking permissions. By default rsyslog creates files with 0644, but in the ubuntu package, the setting is changed to 0640, which means normal users can't read the log file. Using a new action directive (new as in not-legacy), we can specify the file create mode so it doesn't use the default.

Also, when a local environment is destroyed, the normal dir is removed, but the all-machines.log is left around (which I find handy) until the environment is bootstrapped again, then it is removed.

Fix the local provider all-machines.log

There were a number of problems with this as it was, which failed more in trusty as I think the apparmor profile for rsyslogd may have changed or got bugs fixed.

The rsyslog config file was being written by root with 0600 perms. The rsyslog process does a setuid to become the syslog user. The syslog user couldn't read the config file. Now this is written with 0644 so it can be read.

The apparmor profile is quite strict about where rsyslog can write files. Instead of poking with the profile, the local provider now logs to /var/log/juju-{{user}}-{{env name}}/all-machines.log, and a symlink is made in the local provider log dir to point to that file. The file is also created with 0644 so the user can read it without poking permissions. By default rsyslog creates files with 0644, but in the ubuntu package, the setting is changed to 0640, which means normal users can't read the log file. Using a new action directive (new as in not-legacy), we can specify the file create mode so it doesn't use the default.

Also, when a local environment is destroyed, the normal dir is removed, but the all-machines.log is left around (which I find handy) until the environment is bootstrapped again, then it is removed.

[Nate Finch (natefinch)]

LGTM

=== modified file 'environs/cloudinit/cloudinit.go'
--- environs/cloudinit/cloudinit.go	2014-01-28 03:30:11 +0000
+++ environs/cloudinit/cloudinit.go	2014-01-30 22:13:12 +0000
@@ -401,7 +401,7 @@
 	if err != nil {
 		return err
 	}
-	c.AddFile(cfg.RsyslogConfPath, string(content), 0600)
+	c.AddFile(cfg.RsyslogConfPath, string(content), 0644)
 	c.AddRunCmd("restart rsyslog")
 	return nil
 }

=== modified file 'environs/cloudinit/cloudinit_test.go'
--- environs/cloudinit/cloudinit_test.go	2014-01-26 23:28:43 +0000
+++ environs/cloudinit/cloudinit_test.go	2014-01-30 22:13:12 +0000
@@ -111,7 +111,7 @@
 tar zxf \$bin/tools.tar.gz -C \$bin
 rm \$bin/tools\.tar\.gz && rm \$bin/juju1\.2\.3-precise-amd64\.sha256
 printf %s '{"version":"1\.2\.3-precise-amd64","url":"http://foo\.com/tools/releases/juju1\.2\.3-precise-amd64\.tgz","sha256":"1234","size":10}' > \$bin/downloaded-tools\.txt
-install -D -m 600 /dev/null '/etc/rsyslog\.d/25-juju\.conf'
+install -D -m 644 /dev/null '/etc/rsyslog\.d/25-juju\.conf'
 printf '%s\\n' '.*' > '/etc/rsyslog.d/25-juju.conf'
 restart rsyslog
 mkdir -p '/var/lib/juju/agents/machine-0'
@@ -236,7 +236,7 @@
 tar zxf \$bin/tools.tar.gz -C \$bin
 rm \$bin/tools\.tar\.gz && rm \$bin/juju1\.2\.3-linux-amd64\.sha256
 printf %s '{"version":"1\.2\.3-linux-amd64","url":"http://foo\.com/tools/releases/juju1\.2\.3-linux-amd64\.tgz","sha256":"1234","size":10}' > \$bin/downloaded-tools\.txt
-install -D -m 600 /dev/null '/etc/rsyslog\.d/25-juju\.conf'
+install -D -m 644 /dev/null '/etc/rsyslog\.d/25-juju\.conf'
 printf '%s\\n' '.*' > '/etc/rsyslog\.d/25-juju\.conf'
 restart rsyslog
 mkdir -p '/var/lib/juju/agents/machine-99'

=== modified file 'log/syslog/config.go'
--- log/syslog/config.go	2013-11-25 03:36:49 +0000
+++ log/syslog/config.go	2014-01-30 22:13:12 +0000
@@ -19,6 +19,29 @@
 
 // The rsyslog conf for state server nodes.
 // Messages are gathered from other nodes and accumulated in an all-machines.log file.
+//
+// The apparmor profile is quite strict about where rsyslog can write files.
+// Instead of poking with the profile, the local provider now logs to
+// /var/log/juju-{{user}}-{{env name}}/all-machines.log, and a symlink is made
+// in the local provider log dir to point to that file. The file is also
+// created with 0644 so the user can read it without poking permissions. By
+// default rsyslog creates files with 0644, but in the ubuntu package, the
+// setting is changed to 0640, which means normal users can't read the log
+// file. Using a new action directive (new as in not-legacy), we can specify
+// the file create mode so it doesn't use the default.
+//
+// I would dearly love to write the filtering action as follows to avoid setting
+// and resetting the global $FileCreateMode, but alas, precise doesn't support it
+//
+// if $syslogtag startswith "juju{{namespace}}-" then
+//   action(type="omfile"
+//          File="/var/log/juju{{namespace}}/all-machines.log"
+//          Template="JujuLogFormat{{namespace}}"
+//          FileCreateMode="0644")
+// & stop
+//
+// Instead we need to mess with the global FileCreateMode.  We set it back
+// to the ubuntu default after defining our rule.
 const stateServerRsyslogTemplate = `
 $ModLoad imfile
 
@@ -36,8 +59,10 @@
 # so add one in for local messages too if needed.
 $template JujuLogFormat{{namespace}},"%syslogtag:{{tagStart}}:$%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
 
-:syslogtag, startswith, "juju{{namespace}}-" {{logDir}}/all-machines.log;JujuLogFormat{{namespace}}
+$FileCreateMode 0644
+:syslogtag, startswith, "juju{{namespace}}-" /var/log/juju{{namespace}}/all-machines.log;JujuLogFormat{{namespace}}
 & ~
+$FileCreateMode 0640
 `
 
 // The rsyslog conf for non-state server nodes.

=== modified file 'log/syslog/config_test.go'
--- log/syslog/config_test.go	2013-11-21 03:17:02 +0000
+++ log/syslog/config_test.go	2014-01-30 22:13:12 +0000
@@ -57,8 +57,10 @@
 # so add one in for local messages too if needed.
 $template JujuLogFormat,"%syslogtag:6:$%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
 
+$FileCreateMode 0644
 :syslogtag, startswith, "juju-" /var/log/juju/all-machines.log;JujuLogFormat
 & ~
+$FileCreateMode 0640
 `
 
 func (s *SyslogConfigSuite) TestAccumulateConfigRender(c *gc.C) {
@@ -95,8 +97,10 @@
 # so add one in for local messages too if needed.
 $template JujuLogFormat-namespace,"%syslogtag:16:$%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
 
-:syslogtag, startswith, "juju-namespace-" /var/log/juju/all-machines.log;JujuLogFormat-namespace
+$FileCreateMode 0644
+:syslogtag, startswith, "juju-namespace-" /var/log/juju-namespace/all-machines.log;JujuLogFormat-namespace
 & ~
+$FileCreateMode 0640
 `
 
 func (s *SyslogConfigSuite) TestAccumulateConfigRenderWithNamespace(c *gc.C) {

=== modified file 'provider/local/environ.go'
--- provider/local/environ.go	2014-01-24 14:52:58 +0000
+++ provider/local/environ.go	2014-01-30 22:13:12 +0000
@@ -151,6 +151,15 @@
 	mcfg.AptProxySettings = osenv.ProxySettings{}
 	mcfg.ProxySettings = osenv.ProxySettings{}
 	cloudcfg := coreCloudinit.New()
+	// Since rsyslogd is restricted by apparmor to only write to /var/log/**
+	// we now provide a symlink to the written file in the local log dir.
+	// Also, we leave the old all-machines.log file in
+	// /var/log/juju-{{namespace}} until we start the environment again. So
+	// potentially remove it at the start of the cloud-init.
+	logfile := fmt.Sprintf("/var/log/juju-%s/all-machines.log", env.config.namespace())
+	cloudcfg.AddScripts(
+		fmt.Sprintf("[ -f %s ] && rm %s", logfile, logfile),
+		fmt.Sprintf("ln -s %s %s/", logfile, env.config.logDir()))
 	if err := cloudinit.ConfigureJuju(mcfg, cloudcfg); err != nil {
 		return err
 	}