Chef Server does not check for necessary permissions on /var/log
Nobody has claimed this yet.
- Dominant language
- Erlang
- Stars
- 303
- Forks
- 211
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 5
Description
Some customers set /var/log 's mode to 0700, which breaks Chef Server 12.3.1+ initial reconfigure.
/var/log/opscode is either not present or unwritable even if present and the reconfigure fails.
Let's add a preflight check for permissions that verifies /var/log as 0755 and provides a meaningful message with remediation steps to the customer if permissions are not sufficient to permit complete a successful reconfigure.
The original PR (#695 ) changed the directory permissions as part of reconfigure, but this introduces a potential issue where installing Chef Server has an unexpected side effect (changing system directory permissions level) that may run contrary to local security policies.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Trace the Chef Server 12.3.1+ initial reconfigure flow and review the behavior introduced by PR #695. Inspect how /var/log and /var/log/opscode are handled; done means insufficient permissions produce a meaningful remediation message while reconfigure does not silently change /var/log permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100