Page MenuHomePhabricator

Identify possibly problematic file ownership on the NFS filesystems
Closed, ResolvedPublic

Description

In preparation for disabling idmap, inventory files on the NFS filesystem which are not currently owned by (a) root or (b) a uid that is known to be unique accross all instances because it comes from LDAP.

Plausible problematic uids are those managed by apt from a package, which vary depending on the order and set of installed packages.

Once the list of problematic files is extracted, contact project owners with the list for remediation.

Identified outliers:
project deployment-prep:

uid 48
    /home/anomie/.mweval_history
    /data/project/hhvm-cores/
uid 101 (probably syslog)
    /data/project/deployment-salt/log/
    /data//project/hhvm-cores/
uid 103 (also syslog on another system?)
    /data/project/deployment-salt/log/
uid 105 (perhaps another syslog?)
    /data/project/deployment-salt/log/
uid 107
    /data/project/deployment-salt/log/ntpstats/
uid 111
    /data/project/deployment-salt/log/diamond/

project testlabs:

uid 101 (probably syslog)
    /home/syslog 101

project integration:

uid 103 (maybe ssl-certs?)
    /home/yuvipanda

project puppet:

uid 106 (maybe ssl-certs?)
    /home/faidon/certs-bck
uid 110 (mysql?)
    /home/mysql

project wdq-mm:

uid 111
    /data/project/wdq
uid 112
    /home/magnus/replica.my.cnf

project mobile:

uid 113 (mysql?)
    /srv/project/mobile/home/backup-mysql

project orgcharts:

uid 113
    /data/project/olddb/other/

project phabricator:

uid 113
    /home/vcs-user 113

project tools:

uid 113
    /data/project/incolabot/.old/

project wikidata-query:

uid 113 (mysql?)
    /home/mysql
    * Also, do not put a mysql database on NFS

project catgraph:

uid 114
    /home/catgraph.catgraph/elasticsearch/

project gerrit:

uid 114
    /data/project/phabricator-elastic/elasticsearch/

project mediawiki-api:

uid 114
    /home/graphoid/

project shinken:

uid 114
    /home/testakos/

project video:

uid 99
    /data/project/old-cruft-deleteme/

Event Timeline

coren claimed this task.
coren raised the priority of this task from to High.
coren updated the task description. (Show Details)
coren added subscribers: Andrew, yuvipanda, coren.

project deployment-prep:

uid 48
    /home/anomie/.mweval_history
    /data/project/hhvm-cores/
uid 101 (probably syslog)
    /data/project/deployment-salt/log/
    /data//project/hhvm-cores/
uid 103 (also syslog on another system?)
    /data/project/deployment-salt/log/
uid 105 (perhaps another syslog?)
    /data/project/deployment-salt/log/
uid 107
    /data/project/deployment-salt/log/ntpstats/
uid 111
    /data/project/deployment-salt/log/diamond/

project testlabs:

uid 101 (probably syslog)
    /home/syslog 101

project integration:

uid 103 (maybe ssl-certs?)
    /home/yuvipanda

project puppet:

uid 106 (maybe ssl-certs?)
    /home/faidon/certs-bck
uid 110 (mysql?)
    /home/mysql

project wdq-mm:

uid 111
    /data/project/wdq
uid 112
    /home/magnus/replica.my.cnf

project mobile:

uid 113 (mysql?)
    /srv/project/mobile/home/backup-mysql

project orgcharts:

uid 113
    /data/project/olddb/other/

project phabricator:

uid 113
    /home/vcs-user 113

project tools:

uid 113
    /data/project/incolabot/.old/

project wikidata-query:

uid 113 (mysql?)
    /home/mysql
    * Also, do not put a mysql database on NFS

project catgraph:

uid 114
    /home/catgraph.catgraph/elasticsearch/

project gerrit:

uid 114
    /data/project/phabricator-elastic/elasticsearch/

project mediawiki-api:

uid 114
    /home/graphoid/

project shinken:

uid 114
    /home/testakos/

project video:

uid 99
    /data/project/old-cruft-deleteme/

It's all, execpt for the 9.4 million files owned by www-data which - while not puppetized or in ldap - is stable between instances.

The list is made, and labs-announce notified; since none of those will break for now, there is no point in keeping the ticket open.

coren set Security to None.
coren moved this task from Code Review / Blocked to Done on the Labs-Q4-Sprint-2 board.