Skip to content

fix: SSVM entity download URL creation: ensure userdata base dir exists and is writable by www-data - #13967

Open
waterWang wants to merge 1 commit into
apache:mainfrom
waterWang:fix/ssvm-userdata-dir-permission
Open

fix: SSVM entity download URL creation: ensure userdata base dir exists and is writable by www-data#13967
waterWang wants to merge 1 commit into
apache:mainfrom
waterWang:fix/ssvm-userdata-dir-permission

Conversation

@waterWang

Copy link
Copy Markdown

Problem

When handleCreateEntityURLCommand runs on the SSVM (Secondary Storage VM) to build a download URL for e.g. getDiagnosticsData, it creates /var/www/html/userdata/<uuid>/ as the www-data user via su www-data -c "mkdir -p ...". On stock systemvm templates (systemvm-kvm-4.22.0) the /var/www/html/userdata base directory does not exist, and /var/www/html is not writable by www-data, so the mkdir fails with:

Unable to create a link for entity at diagnostics//diagnostics_files_<timestamp>.zip on ssvm,
Error in creating directory =mkdir: cannot create directory '/var/www/html/userdata/<uuid>/': Permission denied

This affects getDiagnosticsData, extractVolume, extractTemplate and any other operation that calls CreateEntityDownloadURLCommand.

Fix

Create the base extract directory (/var/www/html/userdata/) and set its ownership to www-data:www-data before the privilege-dropped su www-data call that creates the per-entity subdirectory. This self-heals the SSVM on first use -- the directory is created by the root process that owns the service, then handed over to www-data for the downstream Apache docroot operations.

Changes

UploadManagerImpl.java -- handleCreateEntityURLCommand: add mkdir -p BASE_EXTRACT_PATH && chown www-data:www-data BASE_EXTRACT_PATH before the existing su www-data subdirectory creation.

+12 / -1 lines.

Closes #13959

…s and is writable by www-data

When handleCreateEntityURLCommand runs on the SSVM it builds the
download URL by creating /var/www/html/userdata/<uuid>/ as the
www-data user (su www-data -c "mkdir -p ..."). On stock systemvm
templates the /var/www/html/userdata base directory does not exist
and /var/www/html is not writable by www-data, so the mkdir fails
with "Permission denied" and getDiagnosticsData / extractVolume /
extractTemplate async jobs error out with code 530 and no download
URL is produced.

Fix: create the base extract directory and set its ownership to
www-data before dropping privileges to create the per-entity
subdirectory. This makes the SSVM self-healing on first use and
matches the directory layout expected by the Apache docroot.

References apache#13959
@DaanHoogland

Copy link
Copy Markdown
Contributor

@waterWang , please rebase on 4.22

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Backlog

Development

Successfully merging this pull request may close these issues.

getDiagnosticsData fails: www-data cannot mkdir /var/www/html/userdata on SSVM (Permission denied)

2 participants