client_acl users no longer able to run commands after upgrading to v0.17

[corywright]

I use client_acl on the salt-master to give my normal user account access to run all salt commands:

client_acl:
  cwright:
    - .*

However, after upgrading from 0.16.4 to 0.17.0 (via Ubuntu packages) I am now unable to run commands as the cwright user, and I receive this error:

$ salt '*' test.ping
Failed to open log file, do you have permission to write to /var/log/salt/master

Users listed in client_acl should be able to run salt commands without requiring filesystem level permission to write to /var/log/salt/master.

[basepi]

Thanks for the report. We will look into this asap and get it fixed.

[basepi]

@thatch45 ping

[dangarthwaite]

This issue hosed my overnight deployments.

[perdurabo93]

Yeah, serious issue for my Jenkins deployments. I'm using an insecure workaround for now but this needs resolved ASAP.

[s0undt3ch]

Users listed in client_acl should be able to run salt commands without requiring filesystem level permission to write to /var/log/salt/master.

And what do you suggest happens to logging?

• No logging at all besides console
• Continue even if unable to write to log file
• No logging at all besides console

[corywright]

@s0undt3ch How did it work before 0.17?

[basepi]

Yes, we're on this. One of our top priorities right now.

[thatch45]

@s0undt3ch, logging is your domain, please lake a look and see if you can make this any better