Merge lp:~tribaal/ubuntu-repository-cache/run-cron-as-root into lp:~tribaal/ubuntu-repository-cache/trunk

[Chris Glass]

This branch lets the sync cron run as root, since juju-run is now a privileged operation.

This juju bug (https://bugs.launchpad.net/juju/+bug/1682411) made juju-run a privileged operation, therefore "dropping" to the www-sync user doesn't work anymore. Note that because of that very bug we didn't actually drop privileges anyway before: we called the code as www-sync but then were given root privileges by juju anyway - unknowingly exploiting a security problem - so this patch shouldn't actually change behavior.

[Francis Ginther (fginther)]

The crontab format requires a user argument.

review: Needs Fixing

[lp:~tribaal/ubuntu-repository-cache/run-cron-as-root]

243. By Chris Glass on 2017-06-20

Added "root" user... crontab and /etc/cron.d have slightly different synthaxes!

[Chris Glass (tribaal)]

review: Abstain

[Francis Ginther (fginther)]

Cron command will run as root now, approve.

review: Approve

=== modified file 'templates/cron/ubuntu-repository-cache_rsync.cron'
--- templates/cron/ubuntu-repository-cache_rsync.cron	2017-04-04 12:12:06 +0000
+++ templates/cron/ubuntu-repository-cache_rsync.cron	2017-06-20 12:42:17 +0000
@@ -7,5 +7,5 @@
 MIRROR_SERIES={{ MirrorSeries }}
 # This cronjob will make the leader sync its view of the metadata with upstream
 # It will then trigger a juju-run to let its peers synchronise.
-{{ Minutes }} * * * * www-sync python3 -m ubuntu_repository_cache.metadata_sync
+{{ Minutes }} * * * * root python3 -m ubuntu_repository_cache.metadata_sync