[Stemcell 3262.12] Permissions for /tmp are 700 instead of 770

[voelzmo]

[Stemcell 3262.12] Permissions for /tmp are 700 instead of 770

[voelzmo]

cc @tylerschultz @holgero @beyhan

[voelzmo]

After some more investigation:

• we have co-located some job that re-starts the agent
• when the agent runs a second time, it also re-sets the permissions to 700 in setupTmpDir
• it doesn't run the code for mounting again, which in stemcell 3262.12 means it also didn't change permissions to 770, see

  bosh-agent/platform/linux_platform.go

  Lines 806 to 818 in cbe532e

  	if !mounted && err == nil {
  	// mount
  	err = bindMounter.Mount(mountSource, mountPoint, "-o", "nodev", "-o", "noexec", "-o", "nosuid")
  	if err != nil {
  	return bosherr.WrapErrorf(err, "Bind mounting %s dir over %s", mountSource, mountPoint)
  	}
  	// change permissions for mount point
  	err = p.changeTmpDirPermissions(mountPoint)
  	if err != nil {
  	return err
  	}
  	} else if err != nil {

• this seems to be fixed on develop, because permission change is now independent of bind-mounting, see https://github.com/cloudfoundry/bosh-agent/blob/develop/platform/linux_platform.go#L821-L839

[dpb587-pivotal]

Nice investigation! I agree with what you've discovered. So, to recap, the issue happens to be fixed on bosh-agent's develop, but we should consider backporting those fixes onto 3262.x because, while most environments won't hit this initially, if the agent crashes or is intentionally restarted we will start seeing this strange and incorrect behavior during standard BOSH lifecycles.

Sounds like something @cppforlife will care about.

[cppforlife]

I believe this could be closed at this point? @voelzmo @dpb587-pivotal

[voelzmo]

yeah, this is fixed in most recent stemcells.