release(package): force chmod permissions without write permissions in the groups #15627

v1v · 2025-02-09T13:26:14Z

Motivation/summary

Linux package apm-server.yml has incorrect file mode 664, causing an error on startup.

I decided to use install instead of changing the umask in the VM itself so the specific requirements are set correctly in the scripts. Tha's how it's done in the fnpm, see

apm-server/packaging/nfpm.yml

Lines 24 to 31 in e8b7251

    
           - src: apm-server.yml 
        
             dst: /etc/apm-server/apm-server.yml 
        
             type: config|noreplace 
        
             file_info: 
        
               mode: 0600 
        
               owner: apm-server 
        
               group: apm-server

Checklist

Update CHANGELOG.asciidoc
Documentation has been updated

For functional changes, consider:

Is it observable through the addition of either logging or metrics?
Is its use being published in telemetry to enable product improvement?
Have system tests been added to avoid regression?

How to test these changes

Download tar.gz files from https://buildkite.com/elastic/apm-server-package/builds/4008

Then

$ ls -l apm-server-9.1.0-linux-arm64
total 129632
-rw-r-----@ 1 vmartinez  staff      3859 Feb  9 14:13 LICENSE.txt
-rw-r-----@ 1 vmartinez  staff    943755 Feb  9 14:13 NOTICE.txt
-rwxrwxr-x@ 1 vmartinez  staff  56754328 Feb  9 14:13 apm-server
-rw-r-----@ 1 vmartinez  staff     39268 Feb  9 14:13 apm-server.yml
-rw-r-----@ 1 vmartinez  staff   8621110 Feb  9 14:13 java-attacher.jar

If you compare to what's the current settings in my local with umask 0022 and umask 0002

$ wget https://artifacts-staging.elastic.co/apm-server/9.1.0-alpha1-3ac48d47/downloads/apm-server/apm-server-9.1.0-alpha1-linux-arm64.tar.gz
$ tar xvzf apm-server-9.1.0-alpha1-linux-arm64.tar.gz 
$ ls -l apm-server-9.1.0-alpha1-linux-arm64
total 129632
-rw-r--r--  1 vmartinez  wheel      3859 Feb  8 01:14 LICENSE.txt
-rw-r--r--  1 vmartinez  wheel    943755 Feb  8 01:14 NOTICE.txt
-rwxr-xr-x  1 vmartinez  wheel  56754328 Feb  8 01:14 apm-server
-rw-r--r--  1 vmartinez  wheel     39268 Feb  8 01:14 apm-server.yml
-rw-r--r--  1 vmartinez  wheel   8621110 Feb  8 01:14 java-attacher.jar
$ rm -rf apm-server-9.1.0-alpha1-linux-arm64* 
$ umask 0002
$ wget https://artifacts-staging.elastic.co/apm-server/9.1.0-alpha1-3ac48d47/downloads/apm-server/apm-server-9.1.0-alpha1-linux-arm64.tar.gz
$ tar xvzf apm-server-9.1.0-alpha1-linux-arm64.tar.gz 
$ ls -l apm-server-9.1.0-alpha1-linux-arm64  
total 129632
-rw-rw-r--  1 vmartinez  wheel      3859 Feb  8 01:14 LICENSE.txt
-rw-rw-r--  1 vmartinez  wheel    943755 Feb  8 01:14 NOTICE.txt
-rwxrwxr-x  1 vmartinez  wheel  56754328 Feb  8 01:14 apm-server
-rw-rw-r--  1 vmartinez  wheel     39268 Feb  8 01:14 apm-server.yml
-rw-rw-r--  1 vmartinez  wheel   8621110 Feb  8 01:14 java-attacher.jar

You can see the file permissions is 640 instead 644 or 664.

Related issues

Closes #15592

…n the groups

packaging.mk

v1v · 2025-02-10T08:42:17Z

Failures are not related to these changes but a bug when testing feature branches for the DRA. I'll fix it in a follow-up

carsonip

Thanks, this fix should work.

we'll need a changelog for this (in this PR or in a separate one)
related to the above, i wonder if we should fix this in 8.17 patch, or just from 8.18 and 9.0. In any case, we shouldn't merge this too soon to avoid it coming out untested in 8.17.2.

packaging.mk

v1v · 2025-02-10T10:25:17Z

I'll add an entry in the changelog after validating if things work after using 600

v1v · 2025-02-10T11:46:09Z

Test

I downloaded
build/distributions/apm-server-9.1.0-SNAPSHOT-linux-x86_64.tar.gz
from this build

$ tar -xvzf apm-server-9.1.0-SNAPSHOT-linux-x86_64.tar.gz 
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/apm-server.yml
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/.build_hash.txt
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/java-attacher.jar
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/LICENSE.txt
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/NOTICE.txt
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/apm-server
$ ls -l apm-server-9.1.0-SNAPSHOT-linux-x86_64
total 134456
-rw-------@ 1 vmartinez  staff      3859 Feb 10 11:30 LICENSE.txt
-rw-------@ 1 vmartinez  staff    943755 Feb 10 11:30 NOTICE.txt
-rwxr-xr-x@ 1 vmartinez  staff  59224216 Feb 10 11:30 apm-server
-rw-------@ 1 vmartinez  staff     39268 Feb 10 11:30 apm-server.yml
-rw-------@ 1 vmartinez  staff   8621110 Feb 10 11:30 java-attacher.jar

v1v · 2025-02-10T11:46:50Z

we'll need a changelog for this (in this PR or in a separate one)

See 1c9a161 (#15627)

related to the above, i wonder if we should fix this in 8.17 patch, or just from 8.18 and 9.0. In any case, we shouldn't merge this too soon to avoid it coming out untested in 8.17.2.

I removed the backport label for 8.17

packaging.mk

changelogs/head.asciidoc

Co-authored-by: Carson Ip <[email protected]>

carsonip

thanks! nit, as discussed, to make a clearer description

changelogs/8.18.asciidoc

changelogs/9.0.asciidoc

Co-authored-by: Carson Ip <[email protected]>

This reverts commit 9872165.

v1v · 2025-02-11T15:36:41Z

Tests

I downloaded this

$ tar -xvzf apm-server-9.1.0-SNAPSHOT-linux-x86_64.tar.gz
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/apm-server.yml
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/.build_hash.txt
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/java-attacher.jar
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/LICENSE.txt
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/NOTICE.txt
x apm-server-9.1.0-SNAPSHOT-linux-x86_64/apm-server
$ ls -l apm-server-9.1.0-SNAPSHOT-linux-x86_64
total 134456
-rw-r--r--@ 1 vmartinez  staff      3859 Feb 11 15:35 LICENSE.txt
-rw-r--r--@ 1 vmartinez  staff    943755 Feb 11 15:35 NOTICE.txt
-rwxr-xr-x@ 1 vmartinez  staff  59224216 Feb 11 15:35 apm-server
-rw-------@ 1 vmartinez  staff     39268 Feb 11 15:35 apm-server.yml
-rw-r--r--@ 1 vmartinez  staff   8621110 Feb 11 15:35 java-attacher.jar

I downloaded this

$ tar -xvzf apm-server-9.1.0-SNAPSHOT-linux-arm64.tar.gz 
x apm-server-9.1.0-SNAPSHOT-linux-arm64/
x apm-server-9.1.0-SNAPSHOT-linux-arm64/apm-server.yml
x apm-server-9.1.0-SNAPSHOT-linux-arm64/.build_hash.txt
x apm-server-9.1.0-SNAPSHOT-linux-arm64/java-attacher.jar
x apm-server-9.1.0-SNAPSHOT-linux-arm64/LICENSE.txt
x apm-server-9.1.0-SNAPSHOT-linux-arm64/NOTICE.txt
x apm-server-9.1.0-SNAPSHOT-linux-arm64/apm-server
$ ls -l apm-server-9.1.0-SNAPSHOT-linux-arm64           
total 129632
-rw-r--r--@ 1 vmartinez  staff      3859 Feb 11 15:36 LICENSE.txt
-rw-r--r--@ 1 vmartinez  staff    943755 Feb 11 15:36 NOTICE.txt
-rwxr-xr-x@ 1 vmartinez  staff  56754328 Feb 11 15:36 apm-server
-rw-------@ 1 vmartinez  staff     39268 Feb 11 15:36 apm-server.yml
-rw-r--r--@ 1 vmartinez  staff   8621110 Feb 11 15:36 java-attacher.jar

…n the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/9.0.asciidoc

…n the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/8.18.asciidoc # changelogs/9.0.asciidoc

…n the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/9.0.asciidoc

…ions in the groups (backport #15627) (#15677) * release(package): force chmod permissions without write permissions in the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/8.18.asciidoc # changelogs/9.0.asciidoc * remove --------- Co-authored-by: Victor Martinez <[email protected]>

…ions in the groups (backport #15627) (#15675) * release(package): force chmod permissions without write permissions in the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/9.0.asciidoc * remove --------- Co-authored-by: Victor Martinez <[email protected]>

…sions in the groups (backport #15627) (#15676) * release(package): force chmod permissions without write permissions in the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/9.0.asciidoc * remove --------- Co-authored-by: Victor Martinez <[email protected]>

release(package): force chmod permissions without write permissions i…

dea99ea

…n the groups

v1v requested a review from a team as a code owner February 9, 2025 13:26

v1v self-assigned this Feb 9, 2025

v1v added backport-8.x Automated backport to the 8.x branch with mergify backport-8.17 Automated backport with mergify backport-8.18 Automated backport to the 8.18 branch backport-9.0 Automated backport to the 9.0 branch labels Feb 9, 2025

v1v mentioned this pull request Feb 9, 2025

Linux package apm-server.yml has incorrect file mode 664 causing error on startup #15592

Closed

v1v commented Feb 9, 2025

View reviewed changes

packaging.mk Outdated Show resolved Hide resolved

carsonip reviewed Feb 10, 2025

View reviewed changes

packaging.mk Outdated Show resolved Hide resolved

v1v removed the backport-8.17 Automated backport with mergify label Feb 10, 2025

Update packaging.mk

b43b89d

changelog

1c9a161

carsonip reviewed Feb 10, 2025

View reviewed changes

packaging.mk Outdated Show resolved Hide resolved

changelogs/head.asciidoc Outdated Show resolved Hide resolved

v1v and others added 3 commits February 10, 2025 15:44

Update packaging.mk

1ca4aec

Co-authored-by: Carson Ip <[email protected]>

changelog

9650713

Merge branch 'main' into feature/set-permissions-dra-packaging

b90b442

v1v requested a review from carsonip February 11, 2025 12:54

carsonip reviewed Feb 11, 2025

View reviewed changes

changelogs/8.18.asciidoc Show resolved Hide resolved

changelogs/9.0.asciidoc Show resolved Hide resolved

Apply suggestions from code review

9872165

Co-authored-by: Carson Ip <[email protected]>

carsonip previously approved these changes Feb 11, 2025

View reviewed changes

v1v added 2 commits February 11, 2025 15:17

Revert "Apply suggestions from code review"

3764da2

This reverts commit 9872165.

normalise permissions

e5d349c

v1v dismissed carsonip’s stale review via e5d349c February 11, 2025 14:29

carsonip approved these changes Feb 11, 2025

View reviewed changes

v1v merged commit 9f75aa4 into main Feb 11, 2025
17 checks passed

v1v deleted the feature/set-permissions-dra-packaging branch February 11, 2025 15:53

mergify bot pushed a commit that referenced this pull request Feb 11, 2025

release(package): force chmod permissions without write permissions i…

f92a4d3

…n the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/9.0.asciidoc

mergify bot pushed a commit that referenced this pull request Feb 11, 2025

release(package): force chmod permissions without write permissions i…

1aa39cf

…n the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/8.18.asciidoc # changelogs/9.0.asciidoc

mergify bot pushed a commit that referenced this pull request Feb 11, 2025

release(package): force chmod permissions without write permissions i…

71497c9

…n the groups (#15627) (cherry picked from commit 9f75aa4) # Conflicts: # changelogs/9.0.asciidoc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

release(package): force chmod permissions without write permissions in the groups #15627

release(package): force chmod permissions without write permissions in the groups #15627

v1v commented Feb 9, 2025 •

edited

Loading

v1v commented Feb 10, 2025

carsonip left a comment •

edited

Loading

v1v commented Feb 10, 2025

v1v commented Feb 10, 2025

v1v commented Feb 10, 2025

carsonip left a comment

v1v commented Feb 11, 2025 •

edited

Loading

	- src: apm-server.yml
	dst: /etc/apm-server/apm-server.yml
	type: config\|noreplace
	file_info:
	mode: 0600
	owner: apm-server
	group: apm-server

release(package): force chmod permissions without write permissions in the groups #15627

release(package): force chmod permissions without write permissions in the groups #15627

Conversation

v1v commented Feb 9, 2025 • edited Loading

Motivation/summary

Checklist

How to test these changes

Related issues

v1v commented Feb 10, 2025

carsonip left a comment • edited Loading

Choose a reason for hiding this comment

v1v commented Feb 10, 2025

v1v commented Feb 10, 2025

Test

v1v commented Feb 10, 2025

carsonip left a comment

Choose a reason for hiding this comment

v1v commented Feb 11, 2025 • edited Loading

Tests

v1v commented Feb 9, 2025 •

edited

Loading

carsonip left a comment •

edited

Loading

v1v commented Feb 11, 2025 •

edited

Loading