[BUG] state `acl.list_absent` doesn't report changes
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
When using the acl.list_absent to make sure an ACL is not present on a file, it removes the ACL, but does not report any changes.
Setup
Example SLS:
Test ACL:
acl.list_absent:
- name: /tmp/foo
- acl_type: group
- acl_names:
- data_operators
groupadd data_operators
touch /tmp/foo
setfacl -m "g:data_operators:r" /tmp/foo
Steps to Reproduce the behavior
Obverse the ACL has an entry for the data_operators group
# getfacl /tmp/foo
getfacl: Removing leading '/' from absolute path names
# file: tmp/foo
# owner: root
# group: root
user::rw-
group::r--
group:data_operators:r--
mask::r--
other::r--
Run the example SLS above:
# salt-call state.apply test_acl --state-verbose True --state-output full test=false
local:
----------
ID: Test ACL
Function: acl.list_absent
Name: /tmp/foo
Result: True
Comment: Permissions are in the desired state
Started: 14:41:06.266731
Duration: 14.892 ms
Changes:
Summary for local
------------
Succeeded: 1
Failed: 0
------------
Total states run: 1
Total run time: 14.892 ms
Note the output doesn't show the state has made a change. But look at the file and observe the ACL has been removed:
# getfacl /tmp/foo
getfacl: Removing leading '/' from absolute path names
# file: tmp/foo
# owner: root
# group: root
user::rw-
group::r--
mask::r--
other::r--
Expected behaviour
The state would report changes, for example:
# salt-call state.apply test_acl --state-verbose True --state-output full test=false
local:
----------
ID: Test ACL
Function: acl.list_absent
Name: /tmp/foo
Result: True
Comment: Removing permissions
Started: 14:42:49.802584
Duration: 21.223 ms
Changes:
----------
removing:
- data_operators
Summary for local
------------
Succeeded: 1 (changed=1)
Failed: 0
------------
Total states run: 1
Total run time: 21.223 ms
Versions Report
# salt --versions-report
Salt Version:
Salt: 3002
Dependency Versions:
cffi: 1.14.5
cherrypy: unknown
dateutil: 2.8.1
docker-py: 4.4.4
gitdb: 4.0.5
gitpython: 3.1.13
Jinja2: 2.11.3
libgit2: Not Installed
M2Crypto: 0.37.1
Mako: Not Installed
msgpack: 0.6.1
msgpack-pure: Not Installed
mysql-python: Not Installed
pycparser: 2.20
pycrypto: Not Installed
pycryptodome: 3.10.1
pygit2: Not Installed
Python: 3.6.8 (default, Nov 16 2020, 16:55:22)
python-gnupg: Not Installed
PyYAML: 5.4.1
PyZMQ: 18.0.2
smmap: 3.0.5
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.3.1
System Versions:
dist: centos 7 Core
locale: UTF-8
machine: x86_64
release: 3.10.0-1160.11.1.el7.x86_64
system: Linux
version: CentOS Linux 7 Core
Additional context
One possible fix is adding the following:
# diff -u linux_acl.orig.py linux_acl.py
--- linux_acl.orig.py 2021-04-22 14:46:27.443529149 +0100
+++ linux_acl.py 2021-04-22 14:46:31.899911526 +0100
@@ -721,6 +721,7 @@
if __opts__["test"]:
ret["result"] = None
return ret
+ ret['changes']['removing'] = acl_names
for acl_name in acl_names:
__salt__["acl.delfacl"](acl_type, acl_name, name, recursive=recurse)
else:
Apologies for not submitting a PR myself, I don't currently have the bandwidth the handle the tests.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect acl.list_absent in linux_acl.py, then reproduce the issue with the example SLS, getfacl, and salt-call commands. Verify that removing the ACL reports the removed group in Changes while a subsequent run is idempotent; add or update tests for this behavior if the surrounding test structure identifies where they belong.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100