Varnish 4.1 Ubuntu package breaks varnishncsa and varnishlog due to missing permissions

[Yggdrasil]

I´m having trouble upgrading Varnish 4.0 to 4.1 on Ubuntu 12.04 and 14.04. So, I tried a clean install of 4.1 on a new VM and it fails too.

Expected Behavior

The varnish daemon correctly starts out-of-the-box. Then the optional varnishncsa service is enabled (was already enabled when upgrading or is enabled on a clean install) via the variable VARNISHNCSA_ENABLED=1 in file /etc/default/varnishncsa.

When I try to start the service via service varnishncsa start the varnishncsa daemon should start running in the background.

Current Behavior

When I try to start the service via service varnishncsa start it fails to start.

root@test01:~# service varnishncsa start
 * Starting HTTP accelerator log deamon                                [fail]
Can't open log - retrying for 5 seconds
Can't open VSM file (Cannot open /var/lib/varnish/test01/_.vsm: Permission denied
)

Possible Solution

The VSM-file´s permissions are:
-rw-r----- 1 root varnish 84934656 May 11 14:58 /var/lib/varnish/test01/_.vsm
when they used to be root:root in Varnish 4.0.

According to https://www.varnish-cache.org/docs/trunk/whats-new/changes.html:

varnishlog, varnishncsa and other Varnish shared log utilities now must be run in a context with varnish group membership.

So, the package should fix group membership on upgrade and installation by adding the user varnishlog to the group varnish, before attempting to start the varnishlog and varnishncsa daemons.

Steps to Reproduce (for bugs)

1. Start an Ubuntu 14.04 VM
2. apt-get install apt-transport-https
3. curl https://repo.varnish-cache.org/GPG-key.txt | apt-key add -
4. echo "deb https://repo.varnish-cache.org/ubuntu/ trusty varnish-4.1" >> /etc/apt/sources.list.d/varnish-cache.list
5. apt-get update && apt-get install varnish
6. echo "VARNISHNCSA_ENABLED=1" > /etc/default/varnishncsa
7. service varnishncsa start

Context

Upgrading from Varnish 4.0 to 4.1 failed because we had enabled the varnishncsa service.

root@test01:/var/lib/varnish/test01# apt full-upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  libvarnishapi1 varnish
2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/588 kB of archives.
After this operation, 113 kB of additional disk space will be used.
Do you want to continue? [Y/n]
(Reading database ... 95839 files and directories currently installed.)
Preparing to unpack .../libvarnishapi1_4.1.2-2~trusty_amd64.deb ...
Unpacking libvarnishapi1 (4.1.2-2~trusty) over (4.0.3-5~trusty) ...
Preparing to unpack .../varnish_4.1.2-2~trusty_amd64.deb ...
 * Stopping HTTP accelerator log deamon varnishncsa                                                                                         [ OK ]
 * Stopping HTTP accelerator
varnishd                                                                                               [ OK ]
Unpacking varnish (4.1.2-2~trusty) over (4.0.3-5~trusty) ...
Processing triggers for ureadahead (0.100.0-16) ...
Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
Setting up libvarnishapi1 (4.1.2-2~trusty) ...
Setting up varnish (4.1.2-2~trusty) ...
Installing new version of config file /etc/init.d/varnish ...

Configuration file '/etc/varnish/default.vcl'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
 ==> Keeping old config file as default.
 * Starting HTTP accelerator
varnish                                                                                               [ OK ]
 * Starting HTTP accelerator log deamon
varnishncsa                                                                                        [fail]
Can't open log - retrying for 5 seconds
Can't open VSM file (Cannot open /var/lib/varnish/test01/_.vsm: Permission denied
)
invoke-rc.d: initscript varnishncsa, action "start" failed.
dpkg: error processing package varnish (--configure):
 subprocess installed post-installation script returned error exit status 1
Processing triggers for libc-bin (2.19-0ubuntu6.7) ...
Processing triggers for ureadahead (0.100.0-16) ...
Errors were encountered while processing:
 varnish
E: Sub-process /usr/bin/dpkg returned an error code (1)

Your Environment

• Amazon VPC, t2.small instance
• Official Ubuntu 14.04.4 image
• Varnish package 4.1.2-2~trusty from http://repo.varnish-cache.org/ubuntu/dists/trusty/

[gquintard]

This is a packaging issue, moved here: varnishcache/pkg-varnish-cache#27