Skip to content

fix: SSVM entity download URL creation: ensure userdata base dir exists and is writable by www-data - #13967

Open
waterWang wants to merge 1 commit into
apache:mainfrom
waterWang:fix/ssvm-userdata-dir-permission
Open

fix: SSVM entity download URL creation: ensure userdata base dir exists and is writable by www-data#13967
waterWang wants to merge 1 commit into
apache:mainfrom
waterWang:fix/ssvm-userdata-dir-permission

Conversation

@waterWang

Copy link
Copy Markdown

Problem

When handleCreateEntityURLCommand runs on the SSVM (Secondary Storage VM) to build a download URL for e.g. getDiagnosticsData, it creates /var/www/html/userdata/<uuid>/ as the www-data user via su www-data -c "mkdir -p ...". On stock systemvm templates (systemvm-kvm-4.22.0) the /var/www/html/userdata base directory does not exist, and /var/www/html is not writable by www-data, so the mkdir fails with:

Unable to create a link for entity at diagnostics//diagnostics_files_<timestamp>.zip on ssvm,
Error in creating directory =mkdir: cannot create directory '/var/www/html/userdata/<uuid>/': Permission denied

This affects getDiagnosticsData, extractVolume, extractTemplate and any other operation that calls CreateEntityDownloadURLCommand.

Fix

Create the base extract directory (/var/www/html/userdata/) and set its ownership to www-data:www-data before the privilege-dropped su www-data call that creates the per-entity subdirectory. This self-heals the SSVM on first use -- the directory is created by the root process that owns the service, then handed over to www-data for the downstream Apache docroot operations.

Changes

UploadManagerImpl.java -- handleCreateEntityURLCommand: add mkdir -p BASE_EXTRACT_PATH && chown www-data:www-data BASE_EXTRACT_PATH before the existing su www-data subdirectory creation.

+12 / -1 lines.

Closes #13959

…s and is writable by www-data

When handleCreateEntityURLCommand runs on the SSVM it builds the
download URL by creating /var/www/html/userdata/<uuid>/ as the
www-data user (su www-data -c "mkdir -p ..."). On stock systemvm
templates the /var/www/html/userdata base directory does not exist
and /var/www/html is not writable by www-data, so the mkdir fails
with "Permission denied" and getDiagnosticsData / extractVolume /
extractTemplate async jobs error out with code 530 and no download
URL is produced.

Fix: create the base extract directory and set its ownership to
www-data before dropping privileges to create the per-entity
subdirectory. This makes the SSVM self-healing on first use and
matches the directory layout expected by the Apache docroot.

References apache#13959
@DaanHoogland

Copy link
Copy Markdown
Contributor

@waterWang , please rebase on 4.22

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

getDiagnosticsData fails: www-data cannot mkdir /var/www/html/userdata on SSVM (Permission denied)

2 participants