Uploaded image for project: 'Multiple Architecture Enablement'
  1. Multiple Architecture Enablement
  2. MULTIARCH-2463

Group ownership for ovs config file is not properly set on Z

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • None
    • 4.10
    • Multi-Arch
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:
      One of Compliance operator (CO) rule "ocp4-cis-node-worker-file-groupowner-ovs-conf-db" reports groupowner permissions not properly set for OVS conf file
       
      The remediation on rule suggest:                         
      Rule description: |-
        To properly set the group owner of /etc/openvswitch/conf.db , run the command:

        $ sudo chgrp hugetlbfs /etc/openvswitch/conf.db
      id: xccdf_org.ssgproject.content_rule_file_groupowner_ovs_conf_db

      This issue is not seen on System P.

      Version-Release number of selected component (if applicable):
      OCP 4.10 and Compliance Operator 0.1.49

      How reproducible:
      Consistently reproducible.

      Steps to Reproduce:
      1.On a 4.10 OCP cluster
      2. login to any of node and check for user and group ownership of /etc/openvswitch/conf.db - it shows as below

      $ ll /etc/openvswitch/conf.db
      rw-r----. 1 openvswitch openvswitch 24930 Apr 6 14:22 /etc/openvswitch/conf.db

      Actual results:
      $ ll /etc/openvswitch/conf.db
      rw-r----. 1 openvswitch openvswitch 24930 Apr 6 14:22 /etc/openvswitch/conf.db

      Expected results:
      groupownership should be "hugetlbfs"

      $ ll /etc/openvswitch/conf.db
      rw-r----. 1 openvswitch hugetlbfs 24930 Apr 6 14:22 /etc/openvswitch/conf.db

      Additional info:
      This issue was found during the testing of compliance operator that the group ownership is incorrect. Once the groupownserhip is set to "hugetlbfs" the compliance scan passes the rule.

              rhn-support-dhorak Daniel Horak
              jira-bugzilla-migration RH Bugzilla Integration
              None
              None
              None
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: