jobs specifying user have incorrect PATH set, can't find scripts
Bug #1252396 reported by
Daniel Manrique
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Checkbox |
Fix Released
|
High
|
Zygmunt Krynicki | ||
Bug Description
How to reproduce:
- install plainbox and plainbox-
- run this:
plainbox run -i mediacard/
Expected result:
- successful run of removable_
Actual result:
Running... (output in /home/ubuntu/
(job mediacard/
Outcome: fail
Comments: None
This affects only jobs that specify user: root. If I remove that line from this job definition, the script runs (but will lack permissions so it will fail for another reason).
Related branches
lp://staging/~zyga/checkbox/path-bug
- Sylvain Pineau (community): Approve
-
Diff: 641 lines (+224/-66)2 files modifiedplainbox/plainbox/impl/ctrl.py (+120/-40)
plainbox/plainbox/impl/test_ctrl.py (+104/-26)
Revision history for this message
| Daniel Manrique (roadmr) wrote | #1 |
| Changed in checkbox: | |
| status: | New → Triaged |
| importance: | Undecided → High |
| milestone: | none → 2013-dec-06 |
| Changed in checkbox: | |
| status: | Triaged → In Progress |
| assignee: | nobody → Zygmunt Krynicki (zkrynicki) |
| Changed in checkbox: | |
| status: | In Progress → Fix Committed |
| Changed in checkbox: | |
| status: | Fix Committed → Fix Released |
| milestone: | 2013-dec-06 → plainbox-0.4b1 |
To post a comment you must log in.
OK, this was traced to using the sudo execution controller, on systems where the invoking user is in the sudo group. Presumably the preferred pkexec execution controller won't exhibit this issue.
The way plainbox gives access to all the scripts from all providers is by creating a "nest", a temporary directory with symlinks to all the scripts, and adding that to the environment's PATH.
The sudo execution controller uses the -E option to sudo, and our thinking was that the modified PATH would be picked up with this option. However, on Ubuntu, /etc/sudoers has a default secure_path defined, and apparently this overrides any changes to the invoking environment's PATH variable. The secure path is as follows:
Defaults secure_
This clobbers our setting of PATH thus causing the scripts in the nest to not be found.
A possible solution to this is relying on env with a list of environment variable values to set, as is done for the pkexec execution controller which is already working.