Jira (PUP-11320) Regression on user resource

35 views
Skip to first unread message

Jouvanceau (Jira)

unread,
Oct 15, 2021, 8:30:03 AM10/15/21
to puppe...@googlegroups.com
Jouvanceau created an issue
 
Puppet / Bug PUP-11320
Regression on user resource
Issue Type: Bug Bug
Affects Versions: PUP 6.24.0, PUP 6.23.0, PUP 6.25.1
Assignee: Unassigned
Created: 2021/10/15 5:29 AM
Priority: Normal Normal
Reporter: Jouvanceau

Puppet Version: 6.23.0 6.24.0 6.24.1 6.25.1
Puppet Server Version: -
OS Name/Version: RHEL 7 RHEL 8 CENTOS 7 CENTOS 8

The user resource is not working as expected since puppet agent 6.23.

During a puppet run, if a user is created by any utility (package / exec), the puppet user resource try to luseradd the same user instead of lusermod as the user already exists.

 

The following code:

exec { '/sbin/luseradd -u 50080 -M myuser': }
-> user { 'myuser':
  uid        => 50081,
  forcelocal => true,
}

produce an error on user resource

Desired Behavior:
before version 6.23

Notice: /Stage[main]/Main/Exec[/sbin/luseradd -u 50080 -M myuser]/returns: executed successfully
Notice: /Stage[main]/Main/User[myuser]/uid: uid changed '50080' to 50081

 

Actual Behavior:
version 6.23 and after

Notice: /Stage[main]/Main/Exec[/sbin/luseradd -u 50080 -M myuser]/returns: executed successfully
Error: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.
Error: /Stage[main]/Main/User[myuser]/ensure: change from 'absent' to 'present' failed: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.

Seem regression introduced by https://tickets.puppetlabs.com/browse/PUP-11067

in the commit :5c8472c

on user.rb adding the line 699

        return [] if self[:ensure] == :present && !provider.exists? 
 

 

Add Comment Add Comment
 
This message was sent by Atlassian Jira (v8.13.2#813002-sha1:c495a97)
Atlassian logo

Franck Jouvanceau (Jira)

unread,
Oct 18, 2021, 5:52:03 AM10/18/21
to puppe...@googlegroups.com
Franck Jouvanceau updated an issue
Change By: Franck Jouvanceau
Affects Version/s: PUP 7.8.0

Franck Jouvanceau (Jira)

unread,
Oct 18, 2021, 5:57:02 AM10/18/21
to puppe...@googlegroups.com
Franck Jouvanceau updated an issue
*Puppet Version: 7.8.0 6.23.0 6.24.0 6.24.1 6.25.1*
*Puppet Server Version:* -
*OS Name/Version: RHEL 7 RHEL 8 CENTOS 7 CENTOS 8*


The user resource is not working as expected since puppet agent 6.23.

During a puppet run, if a user is created by any utility (package / exec), the puppet user resource try to luseradd the same user instead of lusermod as the user already exists.

 

The following code:
{code}exec { '/sbin/luseradd -u 50080 -M myuser': }

-> user { 'myuser':
  uid        => 50081,
  forcelocal => true,
}{code}

produce an error on user resource

*Desired Behavior:*
before version 6.23
{code}Notice: /Stage[main]/Main/Exec[/sbin/luseradd -u 50080 -M myuser]/returns: executed successfully

Notice: /Stage[main]/Main/User[myuser]/uid: uid changed '50080' to 50081
{code}
 

*Actual Behavior:*
version 6.23 and after
{code}Notice: /Stage[main]/Main/Exec[/sbin/luseradd -u 50080 -M myuser]/returns: executed successfully

Error: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.
Error: /Stage[main]/Main/User[myuser]/ensure: change from 'absent' to 'present' failed: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.
{code}


on user.rb adding the line 699
{code}        return [] if self[:ensure] == :present && !provider.exists?
{code}
 


seems puppet 7.9 has been fixed by https://tickets.puppetlabs.com/browse/PUP-11131 but not node on puppet 6

with:
{code:java}
-      if !self[:purge_ssh_keys].empty?
+      if !self[:purge_ssh_keys].empty? && self[:purge_ssh_keys] != :false {code}
 

(I don't see exactly the link between the regression and this purge_ssh_keys setting, but changing this, is fixing it)

Franck Jouvanceau (Jira)

unread,
Oct 18, 2021, 6:00:04 AM10/18/21
to puppe...@googlegroups.com
{code}
 

(I don't see exactly the link between the regression and this purge_ssh_keys setting, but changing this, is fixing it)

Franck Jouvanceau (Jira)

unread,
Oct 18, 2021, 6:00:04 AM10/18/21
to puppe...@googlegroups.com

Franck Jouvanceau (Jira)

unread,
Oct 18, 2021, 8:02:06 AM10/18/21
to puppe...@googlegroups.com


But if the purge_ssh_keys is set to true, it is not working anymore even in puppet 7.12 agent...

{code}
exec { '/sbin/luseradd -u 50080 -M myuser': }
-> user { 'myuser':
  uid            => 50081,
  forcelocal     => true,
  purge_ssh_keys => true,
}
{code}


{code}
Notice: /Stage[main]/Main/Exec[/sbin/luseradd -u 50080 -M myuser]/returns: executed successfully
Error: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.
Error: /Stage[main]/Main/User[myuser]/ensure: change from 'absent' to 'present' failed: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.

{code}

Franck Jouvanceau (Jira)

unread,
Oct 18, 2021, 8:18:02 AM10/18/21
to puppe...@googlegroups.com
Franck Jouvanceau updated an issue
Change By: Franck Jouvanceau
Affects Version/s: PUP 7.12.0
Affects Version/s: PUP 7.9.0
Affects Version/s: PUP 7.10.0
Affects Version/s: PUP 7.11.0
*Puppet Version: 7.8.0 6.23.0 6.24.0 6.24.1 6.25.1*
*Puppet Server Version:* -
*OS Name/Version: RHEL 7 RHEL 8 CENTOS 7 CENTOS 8*

The user resource is not working as expected since puppet agent 6.23 /7 . 8.
seems puppet 7.9 has been fixed by https default behavior withhttps ://tickets.puppetlabs.com/browse/PUP-11131 but not node on puppet 6 .


with:
{code:java}
-      if !self[:purge_ssh_keys].empty?
+     if !self[:purge_ssh_keys].empty? && self[:purge_ssh_keys] != :false
           return [] if self[:ensure] == :present && !provider.exists?
{code}
 

(I don't see exactly the link between the regression and this purge_ssh_keys setting, but changing this, is fixing it)

But if the purge_ssh_keys is set to true, it is not working anymore even in puppet 7.12 agent...
{code}
exec { '/sbin/luseradd -u 50080 -M myuser': }
-> user { 'myuser':
  uid            => 50081,
  forcelocal     => true,
  purge_ssh_keys => true,
}
{code}

{code}
Notice: /Stage[main]/Main/Exec[/sbin/luseradd -u 50080 -M myuser]/returns: executed successfully
Error: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.
Error: /Stage[main]/Main/User[myuser]/ensure: change from 'absent' to 'present' failed: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.

{code}

Ciprian Badescu (Jira)

unread,
Oct 18, 2021, 10:16:03 AM10/18/21
to puppe...@googlegroups.com
Ciprian Badescu updated an issue
Change By: Ciprian Badescu
Team: Night's Watch

Ciprian Badescu (Jira)

unread,
Oct 18, 2021, 10:16:03 AM10/18/21
to puppe...@googlegroups.com
Ciprian Badescu updated an issue
Change By: Ciprian Badescu
Sprint: NW - 2021-11-17

Franck Jouvanceau (Jira)

unread,
Oct 18, 2021, 11:25:03 AM10/18/21
to puppe...@googlegroups.com
Franck Jouvanceau updated an issue
Change By: Franck Jouvanceau
seems puppet 7.9 has fixed default behavior withhttps with https ://tickets.puppetlabs.com/browse/PUP-11131 but not node done on puppet 6.

with:
{code:java}
-      if !self[:purge_ssh_keys].empty?
+     if !self[:purge_ssh_keys].empty? && self[:purge_ssh_keys] != :false
           return [] if self[:ensure] == :present && !provider.exists?
{code}
 

(I don't see exactly the link between the regression and this purge_ssh_keys setting, but changing this, is fixing it)

But if the purge_ssh_keys is set to true, it is not working anymore even in puppet 7.12 agent...
{code}
exec { '/sbin/luseradd -u 50080 -M myuser': }
-> user { 'myuser':
  uid            => 50081,
  forcelocal     => true,
  purge_ssh_keys => true,
}
{code}

{code}
Notice: /Stage[main]/Main/Exec[/sbin/luseradd -u 50080 -M myuser]/returns: executed successfully
Error: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.
Error: /Stage[main]/Main/User[myuser]/ensure: change from 'absent' to 'present' failed: Could not create user myuser: Execution of '/usr/sbin/luseradd -g myuser -u 50081 -M myuser' returned 3: Account creation failed: entry already present in file.

{code}

Ciprian Badescu (Jira)

unread,
Nov 3, 2021, 5:06:03 AM11/3/21
to puppe...@googlegroups.com
Ciprian Badescu updated an issue
Change By: Ciprian Badescu
Story Points: 3

Luchian Nemes (Jira)

unread,
Nov 3, 2021, 6:14:02 AM11/3/21
to puppe...@googlegroups.com
Luchian Nemes assigned an issue to Luchian Nemes
Change By: Luchian Nemes
Assignee: Luchian Nemes

Luchian Nemes (Jira)

unread,
Nov 8, 2021, 9:52:03 AM11/8/21
to puppe...@googlegroups.com
Luchian Nemes commented on Bug PUP-11320
 
Re: Regression on user resource

Franck Jouvanceau could you please detail the use case in the original manifest that surfaced this error to better understand the end goal?

Franck Jouvanceau (Jira)

unread,
Nov 8, 2021, 11:02:04 AM11/8/21
to puppe...@googlegroups.com

A standard use case, is when installing a package, to modify the user created by the package to be compliant with enterprise user management (UID/GID/shell/GECOS).
Some time, the user can be created before installing the package, but some time it is not possible, as the user is hardcoded in postinstall script of package.

This code is working with agent 6.22, but not 6.23. (user/group abrt are not defined on server before run)

On 6.23 it works for the group (uses lgroupmod), but not for the user (wrongly uses lusedadd) => incoherence.

  package { 'abrt':
    ensure => 'present',
  }
  -> group { 'abrt':
    ensure     => 'present',
    gid        => '59998',
    forcelocal => true,
  }
  -> user { 'abrt':
    ensure     => 'present',
    uid        => '59998',
    gid        => '59998',
    forcelocal => true,
  }
 
 
Notice: /Stage[main]/Unx_system::Crash_dump/Package[abrt]/ensure: created (corrective)
Notice: /Stage[main]/Unx_system::Crash_dump/Group[abrt]/gid: gid changed '173' to 59998 (corrective)
Error: Could not create user abrt: Execution of '/usr/sbin/luseradd -g 59998 -d /etc/abrt -s /sbin/nologin -u 59998 -M abrt' returned 3: Account creation failed: entry already present in file.
Error: /Stage[main]/Unx_system::Crash_dump/User[abrt]/ensure: change from 'absent' to 'present' failed: Could not create user abrt: Execution of '/usr/sbin/luseradd -g 59998 -d /etc/abrt -s /sbin/nologin -u 59998 -M abrt' returned 3: Account creation failed: entry already present in file. (corrective)

Ciprian Badescu (Jira)

unread,
Nov 17, 2021, 4:14:02 AM11/17/21
to puppe...@googlegroups.com
Ciprian Badescu updated an issue
Change By: Ciprian Badescu
Sprint: NW - 2021-11-17 , NW - 2021-12-06

Josh Cooper (Jira)

unread,
Dec 2, 2021, 8:53:02 PM12/2/21
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Fix Version/s: PUP 6.26.0
Fix Version/s: PUP 7.13.0

Luchian Nemes (Jira)

unread,
Dec 6, 2021, 3:34:02 AM12/6/21
to puppe...@googlegroups.com
Luchian Nemes updated an issue
Change By: Luchian Nemes
Release Notes: Bug Fix
Release Notes Summary: This release moves the `ssh_authorized_key` resources creation moment at the end of the user type flow, after all user properties and parameters were resolved to avoid order dependency errors.

Parker Leach (Jira)

unread,
Dec 7, 2021, 11:06:03 PM12/7/21
to puppe...@googlegroups.com
Parker Leach updated an issue
Change By: Parker Leach
Labels: docs_reviewed
This message was sent by Atlassian Jira (v8.20.2#820002-sha1:829506d)
Atlassian logo

Josh Cooper (Jira)

unread,
Dec 10, 2021, 1:01:02 AM12/10/21
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Fix Version/s: PUP 7.13.0
Fix Version/s: PUP 7.13.1
Reply all
Reply to author
Forward
0 new messages