749059 - Cannot access subdirectories of fuzzing/ on pvtbuilds

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[Jesse Ruderman]

I can access 
  https://pvtbuilds.mozilla.org/fuzzing/
with my LDAP credentials but I just get "Forbidden" on
  https://pvtbuilds.mozilla.org/fuzzing/mozilla-central-macosx-debug/

I encounter a similar problem after "ssh pvtbuilds2.dmz.scl3.mozilla.com":
  cd: mozilla-central-macosx-debug/: Permission denied

(This stuff was all redone recently, in bug 723340. I expect the fuzzer to create several sibling directories as time goes on.)

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Hm, they're being created with permissions 770.  I've adjusted those three dirs.  Would it be possible to change the directory-creation script?

Comment 2

[Jesse Ruderman]

Hmm. I'm creating them using "mkdir -p", so mozilla-central-macosx-debug/ was created when its first subdirectory was created.

According to man for "mkdir -p":

"Intermediate directories are created with permission bits of rwxrwxrwx (0777) as modified by the current umask, plus write and search permission for the owner."

So I guess I could fix this by issuing two "mkdir -p" commands rather than one.

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Or maybe just set the umask explicitly before running mkdir -p.  This is an LDAP account now, whereas the old username was hand-built, so it's possible the umask is different.

dustin@cerf ~ $ python -c 'import this' | grep implicit
Explicit is better than implicit.

Comment 4

[Jesse Ruderman]

How would I do that?  "umask ... && mkdir -p ..."?  What should I set the umask to?

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Jesse Ruderman from comment #4)
> How would I do that?  "umask ... && mkdir -p ..."?  What should I set the
> umask to?

We could do this if we are in Python:

os.makedirs(path[, mode])

where mode is 770 ? ( http://docs.python.org/library/os.html )

Comment 6

[Jesse Ruderman]

But the Python isn't running on the target machine.

Comment 7

[Dustin J. Mitchell [:dustin] (he/him)]

yes - 'umask 022' should do the trick; its bits are removed from the permissions mask, so 0777-022 = 0755, which is what you want.

Comment 8

[Jesse Ruderman]

I think I got everything working for new directories, but a few of the old ones are still restricted.

Dustin, can you recursively make things og+r one more time?

Comment 9

[Dustin J. Mitchell [:dustin] (he/him)]

[[e-mail]3 ~]# cd /mnt/pvt_builds/fuzzing/
[[e-mail]3 fuzzing]# chmod -R og+r .
[[e-mail]3 fuzzing]#