vomsdir/vomses permission check fails when using cvmfs directories

[marianne013]

When testing a python3 UI on cvmfs I run into a problem when using
/cvmfs/grid.cern.ch/etc/grid-security/vomses (permissions: 775)
and similar locations for my X509 variables
This is caused by

DIRAC/src/DIRAC/Core/Security/VOMS.py

Line 238 in f340453

if (pathMode & allPerms) ^ requiredDirPerms:

which seems to expect the permissions to be 755
It then triggers the shutil bug mentioned in the code (https://bugs.python.org/issue44205) and any DIRAC command using this crashes.

@chrisburr @sfayer is pondering why you aren't using os.access instead ?
And I am wondering why you check for anything beyond read and execute access ?

[marianne013]

And if we fix the directory, we have the same problem with the files, some of which have 644 and others 664.

[chrisburr]

I thought this had been fixed https://github.com/DIRACGrid/DIRAC/pull/5158/files with the workaround. Can you share exactly what error your seeing and how?

@sfayer is pondering why you aren't using os.access instead ? And I am wondering why you check for anything beyond read and execute access ?

I don't know why you're asking me, I was still a child in school when this was written 😆 f2b08c2

[marianne013]

I can't reproduce it on the lxplus. But I see a fundamental difference just by using shutil:
On lxplus:

(base) lxplus784:8.0.0a21 :~] python -V
Python 3.9.10
(base) lxplus784:8.0.0a21 :~] python
Python 3.9.10 | packaged by conda-forge | (main, Feb  1 2022, 21:24:11) 
[GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import shutil
>>> shutil.copytree("/cvmfs/grid.cern.ch/etc/grid-security/vomses/", "/tmp/dbauer667", copy_function=shutil.copy)
'/tmp/dbauer667'

On my local system (v7r3, but that shouldn't matter):

(base) lx04:diracdev_v7r3_py3 > python
Python 3.9.10 | packaged by conda-forge | (main, Feb  1 2022, 21:24:11) 
[GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import shutil
>>> shutil.copytree("/cvmfs/grid.cern.ch/etc/grid-security/vomses/", "/tmp/dbauer666", copy_function=shutil.copy)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/hep/dbauer/diracdev_v7r3_py3/diracos/lib/python3.9/shutil.py", line 566, in copytree
    return _copytree(entries=entries, src=src, dst=dst, symlinks=symlinks,
  File "/home/hep/dbauer/diracdev_v7r3_py3/diracos/lib/python3.9/shutil.py", line 522, in _copytree
    raise Error(errors)
shutil.Error: [('/cvmfs/grid.cern.ch/etc/grid-security/vomses/', '/tmp/dbauer666', "[Errno 28] No space left on device: '/tmp/dbauer666'")]

Note that /tmp isn't full, the error is misleading.
When running this with strace we see:

76289 setxattr("/tmp/dbauer3", "user.timeout_direct", "10", 2, 0) = 0
176289 getxattr("/cvmfs/grid.cern.ch/etc/grid-security/vomses/", "user.timestamp_last_ioerr", "0", 128) = 1
176289 setxattr("/tmp/dbauer3", "user.timestamp_last_ioerr", "0", 1, 0) = -1 ENOSPC (No space left on device)
176289 write(2, "Traceback (most recent call last):\n", 35) = 35
176289 write(2, "  File \"<stdin>\", line 1, in <module>\n", 38) = 38
176289 open("<stdin>", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
176289 open("<stdin>", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)

on our machine, while on lxplus it never looks for xattrs.

The other issue is that it should not try to copy these directories in the first place, as they are accessible, so we should never hit this bit of code.

[chrisburr]

The other issue is that it should not try to copy these directories in the first place, as they are accessible, so we should never hit this bit of code.

IIRC several tools refuse to use the files if the permissions are too relaxed.

[marianne013]

As far as I am aware (and we've been using these directories off cvmfs for years) this does not apply to the voms* dirs. The only point where this is an issue is the proxy and your certificate key. At least in my tests, when I just change this function to bypass the checks, nothing breaks.

[marianne013]

Do I see this correctly and this is a bit of legacy code and no-one actually knows what it's meant to be doing ?
Simon got it to work locally by changing something in our cvmfs config (after muttering something about "poor choice of xattr by cvmfs developers"), but I still think it's testing for something that is not required.

[fstagni]

What's the status of this issue?