Jira (PUP-10501) Error while evaluating a Function Call, Permission denied

[Josh Cooper (Jira)]

Josh Cooper moved an issue

Puppet / PUP-10501 Error while evaluating a Function Call, Permission denied Change By: Josh Cooper Component/s: puppet-runtime Key: PA PUP - 3224 10501 Affects Version/s: puppet-agent 5.5.6 Project: Puppet Agent Add Comment

This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)

[Josh Cooper (Jira)]

Josh Cooper commented on PUP-10501

Re: Error while evaluating a Function Call, Permission denied Functions like your chrony_key execute server-side which runs as the puppet user and is probably why you're getting a permission denied error. If you want the function to execute on the client, then you need to call it using a deferred function, which was introduced in puppet 6. See https://puppet.com/docs/puppet/latest/write_a_puppet_function_to_store_secrets.html That said you could avoid the need for the function if you use onlyif/unless to guard against an empty file instead of creates

Add Comment

[Christian Huck (Jira)]

Christian Huck commented on PUP-10501

Re: Error while evaluating a Function Call, Permission denied

Hi Josh Cooper, thanks for your valuable feedback. I want to execute the function on the server(master) side. I was not aware that those functions calls are executed with non-root user permissions. I was on that track already and took a look inside the /etc/passwd. We have there the followowing users: pe-puppet:x:995:992:pe-puppetserver daemon:/opt/puppetlabs/server/data/puppetserver:/sbin/nologin pe-postgres:x:994:991::/opt/puppetlabs/server/data/postgresql:/sbin/nologin pe-webserver:x:993:990::/var/cache/puppetlabs/nginx:/sbin/nologin pe-puppetdb:x:992:989:pe-puppetdb daemon:/opt/puppetlabs/server/data/puppetdb:/sbin/nologin pe-console-services:x:991:988:pe-console-services daemon:/opt/puppetlabs/server/data/console-services:/sbin/nologin pe-orchestration-services:x:990:987:pe-orchestration-services daemon:/opt/puppetlabs/server/data/orchestration-services:/sbin/nologin So which user will execute the function then ? Thanks in adavance. -Christian

Add Comment

[Christian Huck (Jira)]

Christian Huck commented on PUP-10501

Re: Error while evaluating a Function Call, Permission denied

Found it... chown pe-puppet /etc/chrony_project.key did the trick. Thanks for the hint.

Add Comment

[Gheorghe Popescu (Jira)]

Gheorghe Popescu updated an issue

Puppet / PUP-10501

Error while evaluating a Function Call, Permission denied

Change By: Gheorghe Popescu Release Notes: Not Needed

Add Comment

[Gheorghe Popescu (Jira)]

Gheorghe Popescu updated an issue

Puppet / PUP-10501 Error while evaluating a Function Call, Permission denied

Change By: Gheorghe Popescu Fix Version/s: PUP 6.16.0

Add Comment