Search code examples
puppetselinux

puppet: Not authorized to call find

I'm running puppet 2.7.26 because that's what the redhat package provides.

I'm trying to serve files that are NOT stored within any puppet modules. The files are maintained in another location on the puppet server, and that is where I need to serve them from.

I have this in my /etc/puppet/fileserver.conf

[files]
  path /var/www/cobbler/pub
  allow *

And then I have a class file like this:

class etchostfile
(
  $hostfile              /* declare that this class has one parameter */
)

{
  File
  {
    owner => 'root',
    group => 'root',
    mode => '0644',
  }

  file { $hostfile :
    ensure => file,
    source => "puppet:///files/hosts-${hostfile}.txt",
    path => '/root/hosts',
  }
}

But when my node calls

class { 'etchostfile' :
   hostfile => foo,
}

I get this error

err: /Stage[main]/Etchostfile/File[foo]: Could not evaluate: Error 400 on SERVER: Not authorized to call find on /file_metadata/files/hosts-foo.txt with {:links=>"manage"} Could not retrieve file metadata for puppet:///files/hosts-foo.txt: Error 400 on SERVER: Not authorized to call find on /file_metadata/files/hosts-foo.txt with {:links=>"manage"} at /etc/puppet/modules/etchostfile/manifests/init.pp:27

This post https://viewsby.wordpress.com/2013/04/05/puppet-error-400-on-server-not-authorized-to-call-find/ indicates that this is all I need to do. But I must be missing something.

UPDATE

When I run the master in debug mode, I get no error.

The master responds thusly:

info: access[^/catalog/([^/]+)$]: allowing 'method' find
info: access[^/catalog/([^/]+)$]: allowing $1 access
info: access[^/node/([^/]+)$]: allowing 'method' find
info: access[^/node/([^/]+)$]: allowing $1 access
info: access[/certificate_revocation_list/ca]: allowing 'method' find
info: access[/certificate_revocation_list/ca]: allowing * access
info: access[^/report/([^/]+)$]: allowing 'method' save
info: access[^/report/([^/]+)$]: allowing $1 access
info: access[/file]: allowing * access
info: access[/certificate/ca]: adding authentication any
info: access[/certificate/ca]: allowing 'method' find
info: access[/certificate/ca]: allowing * access
info: access[/certificate/]: adding authentication any
info: access[/certificate/]: allowing 'method' find
info: access[/certificate/]: allowing * access
info: access[/certificate_request]: adding authentication any
info: access[/certificate_request]: allowing 'method' find
info: access[/certificate_request]: allowing 'method' save
info: access[/certificate_request]: allowing * access
info: access[/]: adding authentication any
info: Inserting default '/status' (auth true) ACL because none were found in '/etc/puppet/auth.conf'
info: Expiring the node cache of agent.redacted.com
info: Not using expired node for agent.redacted.com from cache; expired at Thu Aug 13 14:18:48 +0000 2015
info: Caching node for agent.redacted.com 
debug: importing '/etc/puppet/modules/etchostfile/manifests/init.pp' in environment production
debug: Automatically imported etchostfile from etchostfile into production
debug: File[foo]: Adding default for selrange
debug: File[foo]: Adding default for group
debug: File[foo]: Adding default for seluser
debug: File[foo]: Adding default for selrole
debug: File[foo]: Adding default for owner
debug: File[foo]: Adding default for mode
debug: File[foo]: Adding default for seltype
notice: Compiled catalog for agent.redacted.com in environment production in 0.11 seconds
info: mount[files]: allowing * access
debug: Received report to process from agent.redacted.com 
debug: Processing report from agent.redacted.com with processor Puppet::Reports::Store

and the agent responds thusly:

info: Caching catalog for agent.redacted.com
info: Applying configuration version '1439475588'
notice: /Stage[main]/Etchostfile/File[foo]/ensure: defined content as '{md5}75125a96a68a0ff0d42f91f10dca8336'
notice: Finished catalog run in 0.42 seconds

and the file is properly installed/updated.

So it works when the master is in debug mode, but it errors when the master is in standard (?) mode. I can go back and forth, in and out of debug mode at will, and it works every time in debug mode, and it fails every time in standard mode.

UPDATE 2

Running puppetmasterd from the command line, and everything works.

Running service puppetmaster start or /etc/init.d/puppetmaster start from the command line, and it fails. So at least I'm getting closer.

/etc/sysconfig/puppetmaster is entirely commented out. So as of now, I do not see any difference between just starting puppetmasterd and using the service script.

UPDATE 3

I think it's an SELinux problem.

With SELinux "enforcing" on the master, service puppetmaster restart, and I get the error.

I change SELinux to "Permissive" on the master, and I still get the error.

But now that SELinux is set to Permissive, if I service puppetmaster restart, my files get served properly.

But now that it's working, I set SELinux to Enforcing, and I get a different error:

err: /Stage[main]/Etchostfile/File[foo]: Could not evaluate: Could not
retrieve information from environment production source(s)
puppet:///files/hosts-foo.txt at
/etc/puppet/modules/etchostfile/manifests/init.pp:27

Then I do a service puppetmaster restart and I'm back to the original error.

So the situation changes depending on

  • how I started the service (puppetmasterd or service)
  • what SELinux was set to when I started the service
  • what SELinux is set to when the agent runs.

The closer I get, the more confused I get.

UPDATE 4

I think I found it. Once I started looking at SELinux, I found the policy changes I needed to make (allowing ruby/puppet to access cobbler files) and now it appears to be working...

Solution

  • This turned out to be an SELinux problem. I eventually found this error message

    SELinux is preventing /usr/bin/ruby from read access
on the file /var/www/cobbler/pub/hosts-foo.txt .

    which led me to the audit2allow rules I needed to apply to allow puppet to access my cobbler files.