Bug 1212837

Summary:	zgrep complains about lua-lmod files permissions
Product:	[openSUSE] openSUSE Tumbleweed	Reporter:	Christophe Marin <christophe>
Component:	Other	Assignee:	Egbert Eich <eich>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P5 - None	CC:	danilo.spinella, eich, fvogt, jdelvare, meissner
Version:	Current
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Christophe Marin 2023-06-29 07:16:43 UTC

# zgrep --help
/usr/bin/zgrep: /usr/share/lmod/8.7.17/init/bash: Permission non accordée
Usage: /usr/bin/zgrep [OPTION]... [-e] PATTERN [FILE]...

[...]


# ls -l /usr/share/lmod/8.7.17/init     
total 92
-rw-r--r-- 1 root root 5702  8 févr. 17:32 bash
-rw-r--r-- 1 root root 6810  8 févr. 17:32 cmake
-rw-r--r-- 1 root root 1822  8 févr. 17:32 csh
-rw-r--r-- 1 root root 2251  8 févr. 17:32 cshrc
-rw-r--r-- 1 root root 1431  8 févr. 17:32 env_modules_python.py
-rw-r--r-- 1 root root  250  8 févr. 17:32 env_modules_ruby.rb
-rw-r--r-- 1 root root  582  8 févr. 17:32 fish
drwxr-xr-x 1 root root   22  6 juin  22:12 fish_tab_completion
lrwxrwxrwx 1 root root    2  8 févr. 17:32 ksh -> sh
drwxr-xr-x 1 root root   62  6 juin  22:12 ksh_funcs
-rw-r--r-- 1 root root 3342  8 févr. 17:32 lisp
-rw-r--r-- 1 root root 7990  8 févr. 17:32 lmod_bash_completions
-rw-r--r-- 1 root root 1814  8 févr. 17:32 lmodrc.lua
-rw-r--r-- 1 root root  161  8 févr. 17:32 perl
-rw-r--r-- 1 root root 3106  8 févr. 17:32 profile
-rw-r--r-- 1 root root 2099  8 févr. 17:32 profile.fish
-rw-r--r-- 1 root root 2217  8 févr. 17:32 profile.rc
-rw-r--r-- 1 root root  358  8 févr. 17:32 R
-rw-r--r-- 1 root root  762  8 févr. 17:32 rc
-rw-r--r-- 1 root root  853  8 févr. 17:32 sh
lrwxrwxrwx 1 root root    3  8 févr. 17:32 tcsh -> csh
lrwxrwxrwx 1 root root    4  8 févr. 17:32 zsh -> bash

Looks like they should have the executable bit.

Comment 1 Christophe Marin 2023-06-29 07:18:03 UTC

reassigned + added the gzip maintainers to cc

Comment 2 Egbert Eich 2023-06-30 19:55:24 UTC

/usr/share/lmod/8.7.17/init/bash is not a standalone shell script: it gets sourced - like the other files in this directory Therefore, none of these should have the execute bit set.
Furthermore, I've just tested with a freshly updated TW, `zgrep --help` does not give me the strange error message you are seeing.

Comment 3 Christophe Marin 2023-07-04 11:59:33 UTC

[13:55] <krop> can anyone run `zgrep --help` and check if it complains about lmod permissions?
[13:55] <fvogt>  /usr/bin/zgrep: /usr/share/lmod/8.7.17/init/bash: Keine Berechtigung

That confirms it's not a local issue.

Comment 4 Fabian Vogt 2023-07-04 12:00:35 UTC

I see this too. It's because lua-lmod does export BASH_ENV=/usr/share/lmod/8.7.17/init/bash.

zgrep has an apparmor profile which is fairly restrictive and does not allow execution.

I also wonder why lua-lmod is installed at all, FWICT it doesn't provide any generically useful functionality?

The description says:

It is not recommended to install this tool on systems which do not belong
to an HPC deployment which uses the module system.

But still it's installed by default on TW.

Comment 5 Egbert Eich 2023-07-04 13:59:02 UTC

(In reply to Fabian Vogt from comment #4)
> I also wonder why lua-lmod is installed at all, FWICT it doesn't provide any
> generically useful functionality?

Lmod's functionality aims *only* at HPC. 

> The description says:
> 
> It is not recommended to install this tool on systems which do not belong
> to an HPC deployment which uses the module system.
> 
> But still it's installed by default on TW.

Not sure what you mean: I've just tested the software default selections for all 6 system roles available with TW. For none of these lua-lmod is pre-selected. 

If you have such a system, please check what requires it.

Comment 6 Fabian Vogt 2023-07-04 15:06:14 UTC

Meanwhile I found bug 1206957 which is the same issue as here but supposedly fixed.

(In reply to Egbert Eich from comment #5)
> (In reply to Fabian Vogt from comment #4)
> > I also wonder why lua-lmod is installed at all, FWICT it doesn't provide any
> > generically useful functionality?
> 
> Lmod's functionality aims *only* at HPC. 
> 
> > The description says:
> > 
> > It is not recommended to install this tool on systems which do not belong
> > to an HPC deployment which uses the module system.
> > 
> > But still it's installed by default on TW.
> 
> Not sure what you mean: I've just tested the software default selections for
> all 6 system roles available with TW. For none of these lua-lmod is
> pre-selected. 
> 
> If you have such a system, please check what requires it.

> testsolv -W lua-lmod /var/log/zypper.solverTestCase/testcase.t 
installed i2c-tools-4.3-1.10.x86_64@@System:
  update/keep installed
installed lua-lmod-8.7.17-2.1.x86_64@openSUSE-20180203-0:
  i2c-tools-4.3-1.10.x86_64 recommends modules

It's because of the way too generic "Provides: modules" which should be renamed to include "lua" at least.

i2c-tools has a similarly wrong "Recommends:     modules" which should be removed.

I suggest to rename that to lua-modules or similar.

Comment 7 Egbert Eich 2023-07-04 19:29:01 UTC

(In reply to Fabian Vogt from comment #6)
> Meanwhile I found bug 1206957 which is the same issue as here but supposedly
> fixed.

I'm afraid this is not the same. That one triggered Apparmor when trying to run additional commands fron within the inited sources while the one at hand triggers by sourcing (ie. reading) /usr/share/lmod/%version/init/bash itself.
I'm afraid this one can only be fixed by adding an apparmor abstraction extending the existing ones for bash.
A possible solution can now be found and tested in the lua-lmod devel-project.

> (In reply to Egbert Eich from comment #5)
> > (In reply to Fabian Vogt from comment #4)
> > > I also wonder why lua-lmod is installed at all, FWICT it doesn't provide any
> > > generically useful functionality?
> > 
> > Lmod's functionality aims *only* at HPC. 
> > 
> > > The description says:
> > > 
> > > It is not recommended to install this tool on systems which do not belong
> > > to an HPC deployment which uses the module system.
> > > 
> > > But still it's installed by default on TW.
> > 
> > Not sure what you mean: I've just tested the software default selections for
> > all 6 system roles available with TW. For none of these lua-lmod is
> > pre-selected. 
> > 
> > If you have such a system, please check what requires it.
> 
> > testsolv -W lua-lmod /var/log/zypper.solverTestCase/testcase.t 
> installed i2c-tools-4.3-1.10.x86_64@@System:
>   update/keep installed
> installed lua-lmod-8.7.17-2.1.x86_64@openSUSE-20180203-0:
>   i2c-tools-4.3-1.10.x86_64 recommends modules
> 
> It's because of the way too generic "Provides: modules" which should be
> renamed to include "lua" at least.

'modules' is the name of the original implementation of environment modules. This is why this Provides is there.
https://modules.sourceforge.net/
The package 'Modules' exists on TW which provides `environment-modules`.
Maybe this is what Lmod should provide as well.

> i2c-tools has a similarly wrong "Recommends:     modules" which should be
> removed.

Indeed. There is no package 'modules'.

> I suggest to rename that to lua-modules or similar.

This would defy the purpose of this `Provides`.

Comment 8 Egbert Eich 2023-07-04 19:47:04 UTC

@Jean - could you have a look at the line
Recommends:     modules
in the i2c-tools package? There actually is not real package by this name any more on TW. The dependency to lua-lmod was accidental, I've changed it already.
Still, with this line i2c-tools may have undesirable side effects.

Comment 9 Fabian Vogt 2023-07-05 06:37:25 UTC

(In reply to Egbert Eich from comment #7)
> (In reply to Fabian Vogt from comment #6)
> > It's because of the way too generic "Provides: modules" which should be
> > renamed to include "lua" at least.
> 
> 'modules' is the name of the original implementation of environment modules.
> This is why this Provides is there.
> https://modules.sourceforge.net/
> The package 'Modules' exists on TW which provides `environment-modules`.
> Maybe this is what Lmod should provide as well.

IIUC, lua-lmod is another implementation of environment modules.
If this is meant to be a capability provided by any implementation,
"environment-modules" would be correct indeed..

(In reply to Egbert Eich from comment #8)
> @Jean - could you have a look at the line
> Recommends:     modules
> in the i2c-tools package? There actually is not real package by this name
> any more on TW. The dependency to lua-lmod was accidental, I've changed it
> already.
> Still, with this line i2c-tools may have undesirable side effects.

Note that I already opened https://build.opensuse.org/request/show/1096836.

Comment 10 Egbert Eich 2023-07-05 12:10:43 UTC

lua-lmod update with an Apparmor abstraction for bash submitted to Factory -
SR#1096953.

Comment 11 OBSbugzilla Bot 2023-07-06 06:55:03 UTC

This is an autogenerated message for OBS integration:
This bug (1212837) was mentioned in
https://build.opensuse.org/request/show/1097041 Factory / lua-lmod