saltstack / saltstack/salt

dmidecode permission error on master with non-root salt-master

Open
#66,152 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
Error logged in salt master log related to permissions

[salt.loader.lazy :977 ][DEBUG   ][3765414] The functions from module 'core' are being loaded by dir() on the loaded module
[salt.loaded.int.grains.core:1259][INFO    ][3765414] Although 'dmidecode' was found in path, the current user cannot execute it. Grains output might not be accurate.

Setup
Mater running on a physical machine (not observed by cloud/on-prem VM)
master config

fileserver_backend:
  - gitfs
  - roots
git_pillar_provider: gitpython

ext_pillar:
   - git:
     - __env__ ssh://XXXXXXXXXX/YYYYYYY/ZZZZZZZZZZZ:
       - root: pillar/base

top_file_merging_strategy: merge_all
state_top_saltenv: base
gitfs_provider: gitpython

gitfs_remotes:
  - ssh://XXXXXXXXX/YYYYY/ZZZZZZZ:
    - root: salt/base
  - ssh://XXXXXXXX/YYYYYY/WWWWWWWW:
    - root: ''
gitfs_ref_types:
  - branch
file_roots:
  __env__:
    - /AAAAAAAAAAAA

user: salt
  • on-prem machine
  • onedir packaging

Steps to Reproduce the behavior
We run a scheduled highstate every 5 min, but the error seems to be every minute (which is the git refresh period)

08:51:10,325
08:52:13,526
08:53:16,538
08:54:19,486
08:55:22,681
08:56:25,977
08:57:29,077
08:58:32,050
08:59:34,983
09:00:38,172
09:01:41,231
09:02:44,244
09:03:47,302
09:04:50,191
09:05:53,066
09:07:05,845
09:09:08,795
09:10:12,008
09:11:15,338
09:12:18,487
09:13:21,538
09:14:24,422
09:15:27,661

Expected behavior
No errors reported, or they are in the minion log (not master)

Versions Report

salt --versions-report
Salt Version:
          Salt: 3006.7

Python Version:
        Python: 3.10.13 (main, Feb 19 2024, 03:31:20) [GCC 11.2.0]

Dependency Versions:
          cffi: 1.14.6
      cherrypy: unknown
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: 4.0.11
     gitpython: 3.1.41
        Jinja2: 3.1.3
       libgit2: Not Installed
  looseversion: 1.0.2
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 22.0
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.19.1
        pygit2: Not Installed
  python-gnupg: 0.4.8
        PyYAML: 6.0.1
         PyZMQ: 23.2.0
        relenv: 0.15.1
         smmap: 5.0.1
       timelib: 0.2.4
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: debian 11 bullseye
        locale: utf-8
       machine: x86_64
       release: 5.10.0-18-amd64
        system: Linux
       version: Debian GNU/Linux 11 bullseye```
</details>

**Additional context**
We are running the salt-master as non-root user (salt), and the user does indeed not have access to the full dmidecode information.  The salt-minion is running as root and does have access.  This error log is only observed in the /var/log/salt/master log, it is not present in the /var/log/salt/minion on the master or any other minions.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the salt.loaded.int.grains.core entry point named in the log and trace how the dmidecode permission check runs when salt-master uses a non-root account. Reproduce with the supplied non-root master setup and compare master and minion logs. Done means the permission warning no longer appears incorrectly in the master log while minion behavior remains accurate.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.