saltstack / saltstack/salt

[BUG] state `acl.list_absent` doesn't report changes

Open
#60,075 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-medium
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
When using the acl.list_absent to make sure an ACL is not present on a file, it removes the ACL, but does not report any changes.

Setup

Example SLS:

Test ACL:
  acl.list_absent:
    - name: /tmp/foo
    - acl_type: group
    - acl_names:
      - data_operators
groupadd data_operators
touch /tmp/foo
setfacl -m "g:data_operators:r" /tmp/foo

Steps to Reproduce the behavior

Obverse the ACL has an entry for the data_operators group

# getfacl /tmp/foo
getfacl: Removing leading '/' from absolute path names
# file: tmp/foo
# owner: root
# group: root
user::rw-
group::r--
group:data_operators:r--
mask::r--
other::r--

Run the example SLS above:

# salt-call state.apply test_acl --state-verbose True --state-output full test=false
local:
----------
          ID: Test ACL
    Function: acl.list_absent
        Name: /tmp/foo
      Result: True
     Comment: Permissions are in the desired state
     Started: 14:41:06.266731
    Duration: 14.892 ms
     Changes:   

Summary for local
------------
Succeeded: 1
Failed:    0
------------
Total states run:     1
Total run time:  14.892 ms

Note the output doesn't show the state has made a change. But look at the file and observe the ACL has been removed:

# getfacl /tmp/foo
getfacl: Removing leading '/' from absolute path names
# file: tmp/foo
# owner: root
# group: root
user::rw-
group::r--
mask::r--
other::r--

Expected behaviour
The state would report changes, for example:

# salt-call state.apply test_acl --state-verbose True --state-output full test=false
local:
----------
          ID: Test ACL
    Function: acl.list_absent
        Name: /tmp/foo
      Result: True
     Comment: Removing permissions
     Started: 14:42:49.802584
    Duration: 21.223 ms
     Changes:   
              ----------
              removing:
                  - data_operators

Summary for local
------------
Succeeded: 1 (changed=1)
Failed:    0
------------
Total states run:     1
Total run time:  21.223 ms

Versions Report

# salt --versions-report
Salt Version:
          Salt: 3002
 
Dependency Versions:
          cffi: 1.14.5
      cherrypy: unknown
      dateutil: 2.8.1
     docker-py: 4.4.4
         gitdb: 4.0.5
     gitpython: 3.1.13
        Jinja2: 2.11.3
       libgit2: Not Installed
      M2Crypto: 0.37.1
          Mako: Not Installed
       msgpack: 0.6.1
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: 2.20
      pycrypto: Not Installed
  pycryptodome: 3.10.1
        pygit2: Not Installed
        Python: 3.6.8 (default, Nov 16 2020, 16:55:22)
  python-gnupg: Not Installed
        PyYAML: 5.4.1
         PyZMQ: 18.0.2
         smmap: 3.0.5
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.1
 
System Versions:
          dist: centos 7 Core
        locale: UTF-8
       machine: x86_64
       release: 3.10.0-1160.11.1.el7.x86_64
        system: Linux
       version: CentOS Linux 7 Core

Additional context

One possible fix is adding the following:

# diff -u linux_acl.orig.py linux_acl.py 
--- linux_acl.orig.py   2021-04-22 14:46:27.443529149 +0100
+++ linux_acl.py        2021-04-22 14:46:31.899911526 +0100
@@ -721,6 +721,7 @@
             if __opts__["test"]:
                 ret["result"] = None
                 return ret
+            ret['changes']['removing'] = acl_names
             for acl_name in acl_names:
                 __salt__["acl.delfacl"](acl_type, acl_name, name, recursive=recurse)
         else:

Apologies for not submitting a PR myself, I don't currently have the bandwidth the handle the tests.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect acl.list_absent in linux_acl.py, then reproduce the issue with the example SLS, getfacl, and salt-call commands. Verify that removing the ACL reports the removed group in Changes while a subsequent run is idempotent; add or update tests for this behavior if the surrounding test structure identifies where they belong.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.