neutron-dhcp-agent attemps to read pid.haproxy but can't

Bug #2060974 reported by Thomas Goirand
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
Invalid
Undecided
Unassigned

Bug Description

Hi,

From neutron-dhcp-agent.log, I can see it's trying to access:

/var/lib/neutron/external/pids/*.pid.haproxy

It used to be that these files where having the unix rights (at least in Debian 11, aka Bullseye):

-rw-r--r--

However, in Debian 12 (aka Bookworm), for a reason, they now are:

-rw-r-----

and then the agent doesn't have the necessary rights to read these files.

Note that in devstack, these PIDs are owned by the stack user, so that's not an issue. But that's not the case in a Debian package, where haproxy writes these pid files as root:root, when the neutron-dhcp-agent is running under neutron:neutron, and therefore, can't read the files.

One possibility would be reading the PIDs through privsep.

Another fix would be to understand why the PID files aren't world readable. At this point, I can't tell why.

Revision history for this message
Bernard Cafarelli (bcafarel) wrote :

Per IRC last week:
I found out, it's my startup script for neutron-dhcp-agent that has "umask 0026" ...

@zigo so can we close this bug? I do not remember any recent change on that pid file handling in neutron itself

Revision history for this message
Thomas Goirand (thomas-goirand) wrote :

Yeah, please close this bug.

BTW, I found out that this bug comes from applying an ubuntu patch from this bug entry:
https://bugs.debian.org/1014931

So it's well possible that Ubuntu has the issue as well. Just writing this in case someone hits this bug entry.

Revision history for this message
Bernard Cafarelli (bcafarel) wrote :

Thanks for the update and confirmation, the links will come useful if people stumble on this LP

Changed in neutron:
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.