file.managed chmod failed if file attrs has already been set.

[zhujinhe]

Description of Issue/Question

File chmod failed if attrs has already been set.
We should remove attrs --do chmod -- add old attrs back to avoid chmod failure.

Setup

(Please provide relevant configs and/or SLS files (Be sure to remove sensitive info).)

Steps to Reproduce Issue

(Include debug logs if possible and relevant.)

File:

## file mode is 002 and has a(appendonly) attr. failed to change mode to 222.
[root@localhost ~]# ls -alh /var/log/history/history.log
--------w- 1 root root 5.1K Oct 19 16:19 /var/log/history/history.log
[root@localhost ~]# lsattr /var/log/history/history.log
-----a-------e-- /var/log/history/history.log

Salt states:
history_log_file:
  file.managed:
    - name: /var/log/history/history.log
    - user: root
    - group: root
    - mode: 222
    - attrs: a

Output:
      ID: history_log_file
Function: file.managed
    Name: /var/log/history/history.log
  Result: False
 Comment: Failed to change mode to 0222
 Started: 16:19:06.438731
Duration: 1.575 ms
 Changes:

Versions Report

(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)

[root@localhost ~]# salt --versions-report
Salt Version:
           Salt: 2017.7.2

Dependency Versions:
           cffi: Not Installed
       cherrypy: unknown
       dateutil: Not Installed
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.8.1
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 2.7.13 (default, Jul 12 2017, 17:32:34)
   python-gnupg: Not Installed
         PyYAML: 3.11
          PyZMQ: 14.5.0
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.0.5

System Versions:
           dist: centos 6.9 Final
         locale: UTF-8
        machine: x86_64
        release: 2.6.32-431.23.3.el6.x86_64
         system: Linux
        version: CentOS 6.9 Final

[garethgreenaway]

@zhujinhe Thanks for the report!

[Raven-bit]

I'm seeing something I think is related to this, file update fails if attrs have been applied - basically, attributes at least immutable/append only need to be removed before modifications are performed.

Salt Version:
Salt: 2018.3.3

Dependency Versions:
cffi: 1.11.5
cherrypy: Not Installed
dateutil: Not Installed
docker-py: Not Installed
gitdb: 2.0.5
gitpython: 2.1.11
ioflo: Not Installed
Jinja2: 2.10
libgit2: Not Installed
libnacl: Not Installed
M2Crypto: 0.31.0
Mako: 1.0.7
msgpack-pure: Not Installed
msgpack-python: 0.5.6
mysql-python: Not Installed
pycparser: 2.19
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: Not Installed
Python: 2.7.15 (default, Jun 17 2018, 22:57:51)
python-gnupg: Not Installed
PyYAML: 3.13
PyZMQ: 17.1.2
RAET: Not Installed
smmap: 2.0.5
timelib: Not Installed
Tornado: 5.1.1
ZMQ: 4.2.5

System Versions:
dist: slackware 14.2
locale: UTF-8
machine: x86_64
release: 4.15.4
system: Linux
version: Slackware 14.2

[20:13:48 root@vm1:/tmp/foo]$ lsattr /etc/slackpkg/mirrors
----ia--------e---- /etc/slackpkg/mirrors

---

      ID: updater-mirrors
Function: file.managed
    Name: /etc/slackpkg/mirrors
  Result: False
 Comment: Failed to commit change: [Errno 1] Operation not permitted: u'/etc/slackpkg/mirrors'
 Started: 20:14:11.899895
Duration: 56.225 ms
 Changes:   <snipped>

SLS file:
updater-mirrors:
file.managed:

• source: salt://files/etc/slackpkg/mirrors
• name: /etc/slackpkg/mirrors
• user: root
• group: root
• mode: 0644
• attrs: ai

I've removed the attributes for now as a workaround, but it basically makes attributes immutable unless you plan on never updating the file contents.

[j5k]

Same problem here. If i manage a file with i attribute and then change the source file, it fails with "Operation not permitted". As mentioned the i attribute should removed before.

[bdrx312]

Same problem here. If i manage a file with i attribute and then change the source file, it fails with "Operation not permitted". As mentioned the i attribute should removed before.

If the file has an i attribute then shouldn't the file not be able to be changed? This use case you are mentioning is interesting because it seems to me like it is doing the correct thing in that case. The case where it isn't set yet then it should correctly change the contents, mode and attributes, but once set then it seems like the user should have to have a state like a prereq to explicitly remove i or have some kind of flag like force_contents or something if they want to contents changed on an immutable file.