Mailing List Archive

[PATCH] hb_report fails to sudo
Hi,

hb_report in cluster-glue-1.0.8 or later fails on an error even if it
runs as root, at least on RHEL:

---- ---- ---- ---
# id -u
0
# hb_report -f 16:00 report1
sudo: sorry, you must have a tty to run sudo
(...)
---- ---- ---- ---

It seems introduced by this changeset:
http://hg.linux-ha.org/glue/rev/f55d68c37426


Apparently two issues are involved:
1) it tries to use sudo even when invoked as root.
2) sudo may be prohibited without tty on some distros such as RHEL for
a security sake.


The attached patch would fix for 1).
You can workaround it by specifying '-u root' explicitly until it gets fixed.

As for 2), it seems that the current hb_report need to _disable_ tty on ssh, so
you would need an additional configuration to /etc/sudoers on such
distros if you want to use a regular user to ssh.

Regards,

--
Keisuke MORI
Re: [PATCH] hb_report fails to sudo [ In reply to ]
Hi Keisuke-san,

On Tue, Feb 21, 2012 at 09:39:52PM +0900, Keisuke MORI wrote:
> Hi,
>
> hb_report in cluster-glue-1.0.8 or later fails on an error even if it
> runs as root, at least on RHEL:
>
> ---- ---- ---- ---
> # id -u
> 0
> # hb_report -f 16:00 report1
> sudo: sorry, you must have a tty to run sudo

Hmpf.

> (...)
> ---- ---- ---- ---
>
> It seems introduced by this changeset:
> http://hg.linux-ha.org/glue/rev/f55d68c37426
>
>
> Apparently two issues are involved:
> 1) it tries to use sudo even when invoked as root.
> 2) sudo may be prohibited without tty on some distros such as RHEL for
> a security sake.
>
>
> The attached patch would fix for 1).

Patch applied.

> You can workaround it by specifying '-u root' explicitly until it gets fixed.
>
> As for 2), it seems that the current hb_report need to _disable_ tty on ssh, so
> you would need an additional configuration to /etc/sudoers on such
> distros if you want to use a regular user to ssh.

Perhaps hb_report doesn't need to disable tty allocation, but I
thought it would be better so since it runs as a batch program
(also invoked from hb_gui or hawk). I think it was like that
since the beginning but I'll take a look again.

Many thanks for the patch!

Cheers,

Dejan

> Regards,
>
> --
> Keisuke MORI


> _______________________________________________________
> Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
> http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
> Home Page: http://linux-ha.org/

_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/