http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c1 --- Comment #1 from Howard Guo --- Created attachment 710819 --> http://bugzilla.suse.com/attachment.cgi?id=710819&action=edit minion journal -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c3 --- Comment #3 from Howard Guo --- Hi Bo. This problem is trivially reproducible. - Launch 42.2 instances on EC2 - Make one of them a minion - Accept keys on salt master - Run any salt command on salt master and observe its crash. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 Bo Maryniuk changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(hguo@suse.com) | -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 Bo Maryniuk changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |RESOLVED Resolution|--- |WONTFIX -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c11 Duncan Mac-Vicar changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kkaempf@suse.com Flags| |needinfo?(kkaempf@suse.com) --- Comment #11 from Duncan Mac-Vicar --- Howard confirmed removing raet fixes the problem. I reproduced this on AWS: * Installed salt-master, does not automatically pull salt-raet. * Default install works

ec2-user@ip-172-31-14-201:~> sudo salt '*' test.ping ip-172-31-3-176.eu-central-1.compute.internal: True

* Installing salt-raet prevents salt-master from starting * removing it fixes it again. Klaus, I think we should remove salt-raet from the package. It is not going to be developed further, and it looks like because it is not tested, it is creating problems. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 Duncan Mac-Vicar changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low Severity|Normal |Major -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c12 --- Comment #12 from Duncan Mac-Vicar --- I also reproduced this in my own system (Tumbleweed). Installed salt-raet, restart salt-master: Mar 20 13:36:42 piscolita.suse.de salt-master[12365]: File "/usr/lib/python2.7/site-packages/salt/utils/__init__.py", line 1288, in fopen Mar 20 13:36:42 piscolita.suse.de salt-master[12365]: fhandle = open(*args, **kwargs) Mar 20 13:36:42 piscolita.suse.de salt-master[12365]: IOError: [Errno 13] Permission denied: '/etc/salt/minion.d/transport-raet.conf' Problem seems to be the following. The raet module reads /etc/salt/minion.d/transport-raet.conf even on the master. Unfortunately, that file, as the whole minion files are owned by root. Why the master reads the minion config is unknown to me. Is there any reason anyway why the salt-minion files are not owned by group salt with read permissions, like the master files? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c13 --- Comment #13 from Bo Maryniuk --- Sorry, I think I overlooked this one. Looking at it right now. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c15 --- Comment #15 from Duncan Mac-Vicar --- Agreed, there is no need for RAET even as tech preview if we know it does not have a bright future either. However the main issue should also be handled, as raet itself was not the cause of the crash but the way it is packaged/shipped: There are config files shipped in packages for the minion that have -rw-r--r-- root:root that may be read from the master. Most of master config is: drwxr-x--- root:salt package salt-raet shipped config files for both in a single package, and master reads minion config, ergo permission denied. Is there a reason for not having everything as drwxr-x--- root:salt on both sides? private keys?. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c17 --- Comment #17 from Bo Maryniuk --- Raet removed from 2016.x -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:4839:moderate |ibs:running:4839:moderate |ibs:running:4842:moderate |ibs:running:4842:moderate | |ibs:running:4845:moderate -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c20 Bo Maryniuk changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|bmaryniuk@suse.com |qa-bugs@suse.de --- Comment #20 from Bo Maryniuk --- Also, raet has been removed. Please feel free to close this. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c21 --- Comment #21 from Swamp Workflow Management --- SUSE-SU-2017:1581-1: An update that solves two vulnerabilities and has 17 fixes is now available. Category: security (moderate) Bug References: 1011800,1012999,1017078,1020831,1022562,1025896,1027240,1027722,1030009,1030073,1032931,1035912,1035914,1036125,1038855,1039370,1040584,1040886,1043111 CVE References: CVE-2017-5200,CVE-2017-8109 Sources used: SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (src): salt-2016.11.4-42.2 SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (src): salt-2016.11.4-42.2 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c23 Howard Guo changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution|--- |FIXED --- Comment #23 from Howard Guo --- many thanks Bo! -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c24 --- Comment #24 from Swamp Workflow Management --- openSUSE-RU-2017:2161-1: An update that has 11 recommended fixes can now be installed. Category: recommended (important) Bug References: 1020831,1022562,1022841,1023535,1027722,1030009,1030073,1032213,1032452,1032931,1038855 CVE References: Sources used: openSUSE Leap 42.3 (src): salt-2016.11.4-8.1 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c25 --- Comment #25 from Bernhard Wiedemann --- This is an autogenerated message for OBS integration: This bug (1020831) was mentioned in https://build.opensuse.org/request/show/534524 42.2 / salt -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c26 --- Comment #26 from Swamp Workflow Management --- openSUSE-SU-2017:2822-1: An update that solves three vulnerabilities and has 20 fixes is now available. Category: security (moderate) Bug References: 1020831,1022562,1022841,1023535,1027722,1030009,1030073,1032213,1032452,1032931,1035914,1036125,1038855,1040886,1042749,1043111,1052264,1053955,1059758,1061407,1062462,1062464,985112 CVE References: CVE-2017-12791,CVE-2017-14695,CVE-2017-14696 Sources used: openSUSE Leap 42.2 (src): salt-2017.7.2-5.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c28 --- Comment #28 from Swamp Workflow Management --- SUSE-RU-2018:3021-1: An update that solves 5 vulnerabilities and has 125 fixes is now available. Category: recommended (moderate) Bug References: 1002529,1004047,1004260,1004723,1008933,1011304,1011800,1012398,1012999,1017078,1019386,1020831,1022562,1022841,1023535,1025896,1027044,1027240,1027722,1030009,1030073,1032213,1032452,1032931,1035914,1036125,1038855,1039370,1040886,1041993,1042749,1043111,1050003,1051948,1052264,1053376,1053955,1057635,1059291,1059758,1060230,1061407,1062462,1062464,1063419,1064520,1065792,1068446,1068566,1071322,1072599,1075950,1079048,1081592,1087055,1087278,1087581,1087891,1088888,1089112,1089362,1089526,1091371,1092161,1092373,1094055,1095507,1095651,1095942,1096514,1097174,1097413,1098394,1099323,1099460,1099945,1100142,1100225,1100697,1101812,1101880,1102013,1102218,1102265,1103530,1103699,1104154,1106164,1108969,849184,849204,849205,955373,958350,959572,963322,965403,967803,969320,970669,971372,972311,972490,975093,975303,975306,975733,975757,976148,978150,978833,979448,979676,980313,983017,983512,985112,985661,986019,988506,989193,989798,990029,990439,990440,991048,993039,993549,996455,999852 CVE References: CVE-2016-1866,CVE-2016-9639,CVE-2017-12791,CVE-2017-14695,CVE-2017-14696 Sources used: SUSE CaaS Platform 3.0 (src): salt-2018.3.0-2.3.2, sles12-salt-api-image-3.1.0-3.3.2, sles12-salt-master-image-3.1.0-4.3.2, sles12-salt-minion-image-3.1.0-3.3.2 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1020831 http://bugzilla.suse.com/show_bug.cgi?id=1020831#c33 --- Comment #33 from Swamp Workflow Management --- SUSE-OU-2019:13964-1: An update that solves 7 vulnerabilities and has 144 fixes is now available. Category: optional (low) Bug References: 1002529,1004047,1004260,1004723,1008933,1011304,1011800,1012398,1012999,1017078,1019386,1020831,1022562,1022841,1023535,1025896,1027044,1027240,1027722,1030009,1030073,1032213,1032452,1032931,1035914,1036125,1038855,1039370,1040886,1041993,1042749,1043111,1050003,1051948,1052264,1053376,1053955,1057635,1059291,1059758,1060230,1061407,1062462,1062464,1063419,1064520,1065792,1068446,1068566,1071322,1072599,1075950,1079048,1081592,1087055,1087278,1087581,1087891,1088888,1089112,1089362,1089526,1091371,1092161,1092373,1094055,1095507,1095651,1095942,1096514,1097174,1097413,1098394,1099323,1099460,1099887,1099945,1100142,1100225,1100697,1101812,1101880,1102013,1102218,1102265,1103530,1104154,1104491,1106164,1107333,1108557,1108834,1108969,1108995,1109893,1110938,1112874,1113698,1113699,1113784,1114029,1114197,1114474,1114824,1116837,1117995,1121091,1123044,1123512,1123865,849184,849204,849205,955373,958350,959572,963322,965403,967803,969320,970669,971372,972311,972490,975093,975303,975306 ,975733,975757,976148,978150,978833,979448,979676,980313,983017,983512,985112,985661,986019,988506,989193,989798,990029,990439,990440,991048,993039,993549,996455,999852 CVE References: CVE-2016-1866,CVE-2016-9639,CVE-2017-12791,CVE-2017-14695,CVE-2017-14696,CVE-2018-15750,CVE-2018-15751 Sources used: -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1020831 https://bugzilla.suse.com/show_bug.cgi?id=1020831#c38 --- Comment #38 from Swamp Workflow Management --- SUSE-SU-2020:14431-1: An update that solves 11 vulnerabilities and has 251 fixes is now available. Category: security (moderate) Bug References: 1002529,1003449,1004047,1004260,1004723,1008933,1011304,1011800,1012398,1012999,1013876,1013938,1015882,1017078,1019386,1020831,1022562,1022841,1023535,1024406,1025896,1027044,1027240,1027426,1027722,1030009,1030073,1032213,1032452,1032931,1035914,1036125,1038855,1039370,1040886,1041993,1042749,1043111,1044719,1050003,1051948,1052264,1053376,1053955,1057635,1059291,1059758,1060230,1061407,1062462,1062464,1063419,1064520,1065792,1068446,1068566,1070372,1071322,1072599,1075950,1076578,1079048,1080290,1081151,1081592,1083294,1085667,1087055,1087278,1087581,1087891,1088070,1088888,1089112,1089362,1089526,1091371,1092161,1092373,1094055,1094190,1095507,1095651,1095942,1096514,1097174,1097413,1098394,1099323,1099460,1099887,1099945,1100142,1100225,1100697,1101780,1101812,1101880,1102013,1102218,1102265,1102819,1103090,1103530,1103696,1104034,1104154,1104491,1106164,1107333,1108557,1108834,1108969,1108995,1109023,1109893,1110938,1111542,1112874,1113698,1113699,1113784,1114029,1114197,111447 4,1114824,1116343,1116837,1117995,1121091,1121439,1122663,1122680,1123044,1123512,1123865,1124277,1125015,1125610,1125744,1127389,1128061,1128554,1129079,1129243,1130077,1130588,1130784,1131114,1132076,1133523,1133647,1134860,1135360,1135507,1135567,1135656,1135732,1135881,1137642,1138454,1138952,1139761,1140193,1140912,1143301,1146192,1146382,1148311,1148714,1150447,1151650,1151947,1152366,1153090,1153277,1153611,1154620,1154940,1155372,1157465,1157479,1158441,1158940,1159118,1159284,1160931,1162327,1162504,1163871,1165425,1165572,1167437,1167556,1168340,1169604,1169800,1170042,1170104,1170288,1170595,1171687,1171906,1172075,1173072,1174165,769106,769108,776615,849184,849204,849205,879904,887879,889605,892707,902494,908849,926318,932288,945380,948245,955373,958350,959572,963322,965403,967803,969320,970669,971372,972311,972490,975093,975303,975306,975733,975757,976148,977264,978150,978833,979448,979676,980313,983017,983512,985112,985661,986019,987798,988506,989193,989798,990029,9904 39,990440,991048,993039,993549,996455,999852 CVE References: CVE-2016-1866,CVE-2016-9639,CVE-2017-12791,CVE-2017-14695,CVE-2017-14696,CVE-2018-15750,CVE-2018-15751,CVE-2019-17361,CVE-2019-18897,CVE-2020-11651,CVE-2020-11652 Sources used: NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1020831 https://bugzilla.suse.com/show_bug.cgi?id=1020831#c45 --- Comment #45 from Swamp Workflow Management --- SUSE-SU-2021:0316-1: An update that solves 14 vulnerabilities and has 218 fixes is now available. Category: security (moderate) Bug References: 1002529,1004047,1004260,1004723,1008933,1011304,1011800,1012398,1012999,1017078,1019386,1020831,1022562,1022841,1023535,1025896,1027044,1027240,1027722,1030009,1030073,1032213,1032452,1032931,1035914,1036125,1038855,1039370,1040886,1041993,1042749,1043111,1050003,1051948,1052264,1053376,1053955,1057635,1059291,1059758,1060230,1061407,1062462,1062464,1063419,1064520,1065792,1068446,1068566,1071322,1072599,1075950,1079048,1081592,1083110,1087055,1087278,1087581,1087891,1088888,1089112,1089362,1089526,1091371,1092161,1092373,1094055,1095507,1095651,1095942,1096514,1097174,1097413,1098394,1099323,1099460,1099887,1099945,1100142,1100225,1100697,1101780,1101812,1101880,1102013,1102218,1102248,1102265,1102819,1103530,1104154,1104491,1106164,1107333,1108557,1108834,1108969,1108995,1109893,1110938,1112874,1113698,1113699,1113784,1114029,1114197,1114474,1114824,1116343,1116837,1117995,1121091,1121439,1122663,1122680,1123044,1123512,1123865,1124277,1125015,1128061,1128554,1129079,1130588,113078 4,1131114,1132076,1133523,1133647,1134860,1135360,1135507,1135567,1135656,1135732,1137642,1138952,1139761,1140193,1140912,1143301,1146192,1146382,1148714,1150447,1151650,1151947,1152366,1153611,1154620,1157465,1157479,1158441,1158940,1159118,1159284,1159670,1160931,1162327,1162504,1165425,1165572,1167437,1167556,1168340,1169604,1169800,1170042,1170104,1170288,1170595,1171461,1171906,1172075,1172211,1173072,1173909,1173911,1173936,1174165,1175549,1175987,1176024,1176294,1176397,1176480,1177867,1178319,1178361,1178362,1178485,849184,849204,849205,955373,958350,959572,963322,965403,967803,969320,970669,971372,972311,972490,975093,975303,975306,975733,975757,976148,978150,978833,979448,979676,980313,983017,983512,985112,985661,986019,988506,989193,989798,990029,990439,990440,991048,993039,993549,996455,999852 CVE References: CVE-2016-1866,CVE-2016-9639,CVE-2017-12791,CVE-2017-14695,CVE-2017-14696,CVE-2018-15750,CVE-2018-15751,CVE-2019-17361,CVE-2019-18897,CVE-2020-11651,CVE-2020-11652,CVE-2020-16846,CVE-2020-17490,CVE-2020-25592 JIRA References: Sources used: NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.