2

Background:

I am upgrading our lxc puppet module to support the emerging unprivileged LXC technology.

The code that creates the container is executed unless the following test if the container exists succeeds: lxc-info -n ${lxcname} >/dev/null. If executed as root, the lxc-info checks for the name among the root containers. If invoked by a normal user, it checks against the list of unprivileged containers stored for this particular user.

I want to create a resource along the lines of (code not tested yet):

#Creation of the container ${name}
  exec { "lxc-create of ${hostname}":
    command => "lxc-create -t download -n ${name} -- -d ubuntu -r ${release} -a amd64",
    user    => $user,
    group   => $group,
    timeout => 0,
    unless  => "lxc-info -n ${name}" #Should be executed as user ${user}, not root!
  }

I can fix this problem if I change the last parameter to

unless  => "su -l ${user} -c 'lxc-info -n ${name}'"

but it just don't look elegant. Is there any built-in solution in puppet to make a check as other user?

4
  • 2
    Strange, I cannot reproduce with 2.7.22 or 3.7.3. I don't have LXC, but did a simple test: puppet apply -e 'exec { "/bin/cat /root/test": user => "nobody", onlyif => "/usr/bin/test -r /root/test" }'. As expected, it will not try to sync the exec if run as non-root. Apparently, the user parameter does apply to the onlyif parameter. A reverse test indicates that unless behaves the same way. Dec 17, 2014 at 10:23
  • @FelixFrank Thank you. I actually assumed, that it gets executed by root, since the documentation never mentions otherwise. I'll confirm it soon. Dec 17, 2014 at 10:28
  • 1
    Wait what, you haven't even tried but asked the question based on an assumption? Dec 17, 2014 at 12:30
  • @FelixFrank Yes. I admit to being lazy. Shame on me. IMHO The documentation should be more accurate though. Dec 18, 2014 at 17:28

1 Answer 1

2

As Felix said, the unless uses the same user as the main command.

From the documentation:

unless

... Note that this command follows the same rules as the main command

This has now been clarified in the documentation: https://github.com/puppetlabs/puppet/pull/3800/files

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .