Re: Failsafe.cf in cfengine 3.18

Thierry,

perhaps this change of default behavior for purging non-existant files is
the behavior change you see: https://tracker.mender.io/browse/CFE-3662

On Wed, Nov 3, 2021 at 12:08 PM Nick Anderson <[email protected]>
wrote:

> thierry thunot <[email protected]> writes:
>
> Hello all ;) i have a question about cfengine 3.18 and the automatic
>> generation of failsafe.cf in /var/cfengine/input. How can I generate
>> this file on 3.18, does it work differently?
>>
> Hi Thierry,
>
> failsafe.cf is generated when non-interactive policy runs fail syntax
> validation.
>
> For example, here we can see that:
>
>    -
>
>    Initially failsafe.cf does *not* exist in inputs.
>
>    [root@hub ~]# ls /var/cfengine/inputs/
>    cfbs  cfe_internal  cf_promises_release_id  cf_promises_validated  controls  def.json  inventory  lib  modules  promises.cf  services  standalone_self_upgrade.cf  templates  update.cf
>
>    -
>
>    We break the policy
>
>    [root@hub ~]# echo BROKEN >> /var/cfengine/masterfiles/promises.cf
>
>    -
>
>    We initiate cf-execd to run once, it detects failure, but skips
>    generation of failsafe.cf since interactive mode is detected.
>
>    [root@hub ~]# cf-execd -KIFO
>    /var/cfengine/inputs/promises.cf:393:7: error: syntax error
>    BROKEN
>          ^
>    /var/cfengine/inputs/promises.cf:393:7: error: Expected 'bundle' or 'body' keyword, wrong input 'BROKEN'
>    BROKEN
>          ^
>       error: There are syntax errors in policy files
>       error: Policy failed validation with command '"/var/cfengine/bin/cf-promises" -c "/var/cfengine/inputs/promises.cf"'
>       error: Failsafe condition triggered. Interactive session detected, skipping failsafe.cf execution.
>       error: Error reading CFEngine policy. Exiting...
>
>    -
>
>    Indeed, no failsafe.cf is present in inputs
>
>    [root@hub ~]# ls /var/cfengine/inputs/
>    cfbs  cfe_internal  cf_promises_release_id  cf_promises_validated  controls  def.json  inventory  lib  modules  promises.cf  services  standalone_self_upgrade.cf  templates  update.cf
>
>    -
>
>    We wait for an unattended, non-interactive execution and check again
>    seeing that indeed, there is a failsafe.cf present
>
>    [root@hub ~]# sleep 300; ls /var/cfengine/inputs
>    cfbs          cf_promises_release_id          cf_promises_validated          controls  failsafe.cf  lib      promises.cf  standalone_self_upgrade.cf  update.cf
>    cfe_internal  cf_promises_release_id.cfsaved  cf_promises_validated.cfsaved  def.json  inventory    modules  services     templates
>
>
> Note: cf-agent --bootstrap leverages the internal failsafe.cf, and you
> can find it in our source here
> <https://github.com/cfengine/core/blob/master/libpromises/failsafe.cf>.
>
> I would expect the policy update to be handled by update.cf. Can you
> explain how you use failsafe.cf to update your policy?
>
> Have you ever noticed this behavior?
>>
> I try to avoid committing broken policy that results in failsafe.cf being
> used. I have memory that there may be some bug or desired feature around
> not using a generated failsafe.cf if a custom one is present but I am
> unsure if that's actually a bug or a feature request or if there is a
> ticket for it or even how it could be accomplished to reliably allow a
> custom failsafe.cf to be used instead (i guess we could look for a
> preferred_failsafe.cf and use that if present instead of the internally
> generated one).
> --
> Nick Anderson | Doer of Things | (+1) 785-550-1767 | https://northern.tech
>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/CAE46pPsKRJd5F%2BrkwWtBfA%2BwjiUzW7JtTurd0G9m%3DnY5SgBWJQ%40mail.gmail.com.