[savannah-help-public] [sr #109392] CVS access for web pages failed

[Heiko Stamer]

URL:
<http://savannah.gnu.org/support/?109392>

Summary: CVS access for web pages failed
Project: Savannah Administration
Submitted by: stamer
Submitted on: Thu 28 Sep 2017 07:38:41 PM CEST
Category: Project webpages
Priority: 5 - Normal
Severity: 3 - Normal
Status: None
Assigned to: None
Originator Email:
Operating System: None
Open/Closed: Open
Discussion Lock: Any

_______________________________________________________

Details:

When uploading a webpage for my new project I got the following permission
error:

$ cvs commit
cvs commit: Examining .
cvs commit: ERROR: cannot write file /web/dkgpg/dkgpg/index.html,v: Permission
denied





_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Bob Proulx]

Update of sr #109392 (project administration):

Status: None => Need Info
Assigned to: None => rwp

_______________________________________________________

Follow-up Comment #1:

I examined your project setup and configuration on the server and I did not
find anything out of the ordinary. Therefore we need more information.

How did you checkout your working copy? Did you by happenstance checkout
using the anonymous pserver instead of your ssh login? So update you will
need the "Project Member CVS Access via SSH" instructions at
https://savannah.nongnu.org/cvs/?group=dkgpg in order to be able to commit.

You can check on how you did the checkout by looking at any of the CVS/Root
files. It should say something like this:

cat CVS/Root
:ext:***@cvs.savannah.gnu.org:/webcvs/dkgpg

cvs -z3 -d:ext:***@cvs.savannah.nongnu.org:/web/dkgpg co dkgpg

If that isn't the problem then we will need more information to debug it
further.


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Heiko Stamer]

Follow-up Comment #2, sr #109392 (project administration):

I checked out the repository as explained in the instructions.

$ cat CVS/Root
:ext:***@cvs.savannah.nongnu.org:/web/dkgpg

Unfortunately, the result is still the same:

$ cvs commit
cvs commit: Examining .
cvs commit: ERROR: cannot write file /web/dkgpg/dkgpg/index.html,v: Permission
denied
cvs commit: saving log message in /tmp/cvsAtOaA2

The webpage access for my other project (libtmcg) works. Thus I guess it is a
group permission problem with the new project at the server. What information
you need to debug?

_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Assaf Gordon]

Follow-up Comment #3, sr #109392 (project administration):

Hi Bob and all,

Heiko mentioned this is a new repository,
and this reminded me a previous instance:

https://lists.gnu.org/archive/html/savannah-hackers-public/2016-05/msg00022.html

Perhaps related to the fact that the actual CVS repos are nfs-mounted from old
VCS, and root-squash prevents something from working ?

I'm almost certain I also handled something similar long ago, can't seem to
find it though....

-assaf

_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Assaf Gordon]

Follow-up Comment #4, sr #109392 (project administration):

Ah,

I was thinking of another issue (missing lock directory):

https://lists.gnu.org/archive/html/savannah-hackers-public/2017-01/msg00045.html

But it is not the case here, as vcs0:/var/lock/cvs/web/dkgpg/ does exist.

Sorry for the noise.
- assaf


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Bob Proulx]

Follow-up Comment #5, sr #109392 (project administration):

I added myself to the project so that I could debug the problem. With that I
can recreate the problem with my login. I see nothing interesting in any of
the normal logs. I will need to instrument things in order to debug this
further.

_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Heiko Stamer]

Follow-up Comment #6, sr #109392 (project administration):

I found a similar issue here:

https://lists.gnu.org/archive/html/savannah-hackers-public/2017-08/msg00012.html

_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Bob Proulx]

Follow-up Comment #7, sr #109392 (project administration):

Sorry for the delays in figuring this problem out. Thank you for the
additional information. That is a slightly different problem however. That
one is due to the www team needing access to the files and therefore ACLs are
used to allow it. I checked and the www ACL looks okay. But that isn't what
is not working for you (and me since I can recreate it) now. It's still in
the top of my queue. I'll work on it some more later today.


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Ian Dunn]

Follow-up Comment #8, sr #109392 (project administration):

I'm experiencing this issue with my project paced. Here's what I do:

$ cvs -z3 -d:ext:***@cvs.savannah.nongnu.org:/web/paced-el co paced-el
cvs checkout: Updating paced-el
$ cd paced-el/
$ touch index.html
$ cvs add index.html
cvs add: scheduling file `index.html' for addition
cvs add: use `cvs commit' to add this file permanently
$ cvs commit -m "Added documentation" index.html
cvs commit: ERROR: cannot write file /web/paced-el/paced-el/index.html,v:
Permission denied

The only bash settings I've changed for CVS are:
CVS_RSH=ssh
CVS_CLIENT_LOG="log"

I can post the log.in and log.out files, if that would help.

I can commit web pages for my project org-edna just fine, as I did a minute
prior to first experiencing this problem with paced-el.

_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Bob Proulx]

Update of sr #109392 (project administration):

Status: Need Info => Done
Open/Closed: Open => Closed

_______________________________________________________

Follow-up Comment #9:

This problem is due to incorrect file ACLs. Please test the access again for
both projects. I believe both of these projects should be working now.

Sorry Heiko for the long delay in debugging this problem.

I am not sure why the facl permissions were incorrect for these. I need to
ensure that all of the projects have the correct facl permissions as I am sure
that if these were incorrect that others will be incorrect too.


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Heiko Stamer]

Follow-up Comment #10, sr #109392 (project administration):

Unfortunately, on my side the issue remains (I have checked out the web pages
repository again):

$ cvs commit
cvs commit: Examining .
cvs commit: ERROR: cannot write file /web/dkgpg/dkgpg/index.html,v: Permission
denied
cvs commit: saving log message in /tmp/cvs5Ey9zv


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Bob Proulx]

Follow-up Comment #11, sr #109392 (project administration):

I am wondering if there is an errant cronjob that is fighting with me on these
files. The desired facl from a working directory is:

vcs:/# getfacl web/coreutils
# file: web/coreutils
# owner: root
# group: coreutils
# flags: -s-
user::rwx
group::rwx
group:www:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:www:rwx
default:mask::rwx
default:other::r-x

Although that may be overspecified for our needs that listing is a working
example. I had cloned that for both paced-el and dkgpg using this command, it
was still in my recall history

vcs:/# getfacl web/coreutils | setfacl --set-file=- web/dkgpg

But at this moment when I look after your latest failure report i see that it
has changed. The bad state is:

vcs:/# getfacl web/dkgpg/dkgpg
# file: web/dkgpg/dkgpg
# owner: root
# group: dkgpg
# flags: -s-
user::rwx
group::r-x
group:www:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::r-x
default:group:www:rwx
default:mask::rwx
default:other::r-x

The "default:group::r-x" part is causing the trouble. I have reset it, and I
will say again since the command for that is still in my recall history. Plus
I had added myself to the project to test the operation. This is for the
subdirectory.

vcs:/# getfacl web/coreutils/coreutils | setfacl --set-file=- web/dkgpg/dkgpg

Please try it again. Sorry for all of the hassles here.


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Heiko Stamer]

Follow-up Comment #12, sr #109392 (project administration):

Thanks for your effort. Now the error message has changed:

$ cvs commit
cvs commit: Examining .
/web/dkgpg/dkgpg/index.html,v <-- index.html
initial revision: 1.1
cvs commit: warning: cannot open history file `/web/dkgpg/CVSROOT/history' for
write: Permission denied
Triggering webpages update...


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Bob Proulx]

Follow-up Comment #13, sr #109392 (project administration):

Sigh. At least we are making progress through the files! :-)

I adjusted those facls. Please give it another try.


_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/

[Heiko Stamer]

Follow-up Comment #14, sr #109392 (project administration):

It works now. Thank you!

_______________________________________________________

Reply to this item at:

<http://savannah.gnu.org/support/?109392>

_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/