Re: Could not load requested further augments from file

"'Vratislav Podzimek' via help-cfengine" <[email protected]> Mon, 19 Aug 2024 08:12:18 +0200
Newsgroups	gmane.comp.sysutils.cfengine.general
Message-ID	<[email protected]>
Hello,

On Fri, 2024-08-16 at 14:06 -0700, Beto wrote:
> Weird thing is this occurs ONLY on RHEL8, not on RHEL7 and  this same augments configuration has been in use for years.
That suggests the difference is most likely SELinux. Does it happen even if you
do a manual agent run from an interactive shell with `cf-agent -KI`? If not,
please double-check `ausearch -m AVC` on an affected system.

Another alternative is to run `strace -ff -- cf-agent -KI 2> cf-agent.strace`,
look for the particular file name in the trace and see what happens when the
file is attempted to be opened and read.

> 
> I thought maybe I could use host_specific.json to get around this issue but I can't tell that host_specific.json is being seen at all (as you say the doc is "imprecise").
What do you think is imprecise in the docs? I think it's quite clear:

   There are two canonical augments files, host_specific.json, and def.json
   which may load additional Augments as specified by the augments key.
   
   Notes:
       CFEngine variables are not expanded unless otherwise noted.
   
and then there is a note for the def.json file:

   sys variables are expanded in def.json and all subsequently loaded augments
   as specified by the augments key.
   
You can do a verbose agent run using `--verbose` to see details of what it is doing
and which files it is loading.

One thing is quite clear -- the error message that further augments could not be
loaded should be enhanced to explain why.

--
Vratislav

> 
> On Friday, August 16, 2024 at 4:00:51 PM UTC-5 Beto wrote:
> > There are no selinux AVCs logged.
> > 
> > On Friday, August 16, 2024 at 3:42:41 PM UTC-5 [email protected] wrote:
> > > Def.jq might itself be special what about def.foo? 
> > > 
> > > On Fri, Aug 16, 2024, 3:10 PM '[email protected]' via help-cfengine <[email protected]> wrote:
> > > > The docs might be a bit imprecise. https://docs.cfengine.com/docs/3.24/reference-language-concepts-augments.html says in two separate notes:
> > > > 
> > > >  * CFEngine variables are not expanded unless otherwise noted.
> > > >  * sys variables are expanded in def.json and all subsequently loaded augments as specified by the augments key.
> > > > ---
> > > > 
> > > > I did a little test and it does seem your def.network and sys variables should both be expanded so I wonder if it is an access or selinux issue?
> > > > 
> > > > Maybe check /var/log/audit/audit.log for cf-serverd related entries?
> > > > 
> > > > ---
> > > > 
> > > > My test:
> > > > $ cat def.json 
> > > > {
> > > >   "vars": {
> > > >     "foo": "${def.jq}",
> > > >     "bar": "baz"
> > > >   }
> > > > }
> > > > 
> > > > $ cat t.cf 
> > > > bundle agent main
> > > > {
> > > >   reports:
> > > >  "foo is ${default:def.foo}";
> > > >  "bar is ${default:def.bar}";
> > > >  "def.jq is ${def.jq}";
> > > > }
> > > > 
> > > > result:
> > > > R: foo is jq --compact-output --monochrome-output --ascii-output --unbuffered --sort-keys
> > > > R: bar is baz
> > > > R: def.jq is jq --compact-output --monochrome-output --ascii-output --unbuffered --sort-keys
> > > > On Friday, August 16, 2024 at 2:57:53 PM UTC-5 Nick Anderson wrote:
> > > > > I dont think you can use non sys variables in augments like that becuase augmwnts is loaded before policy is read at all. Check the augments docs (i can't atm, on the move). 
> > > > > 
> > > > > On Fri, Aug 16, 2024, 1:43 PM Beto <[email protected]> wrote:
> > > > > > As we upgrade from RHEL7 to RHEL8 I'm seeing this in /var/log/messages:
> > > > > > 
> > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server)  Rereading policy file '/var/cfengine/inputs/promises.cf'
> > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]:   error: Could not load requested further augments from file '/srv/sysadmin/etc/
> > > > > > cfengine/augments.json'
> > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]:   error: Could not load requested further augments from file '$(sys.inputdir)/au
> > > > > > gments/augments_$(def.network).json'
> > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server)  Could not load requested further augments from file '/srv/sysa
> > > > > > dmin/etc/cfengine/augments.json'
> > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server)  Could not load requested further augments from file '$(sys.inp
> > > > > > utdir)/augments/augments_$(def.network).json'
> > > > > > 
> > > > > > Not seeing this on RHEL7.
> > > > > > 
> > > > > > CFEngine Core 3.24.0
> > > > > > CFEngine Enterprise 3.24.0
> > > > > > 
> > > > > > Any ideas?
> > > > > > -- 
> > > > > > You received this message because you are subscribed to the Google Groups "help-cfengine" group.
> > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> > > > > > To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/857f33e7-4ac3-45f1-8b90-234de4c98bc8n%40googlegroups.com.

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/826c8ef0e86e0e55b6bcf4e93e35eaa85569b9ca.camel%40northern.tech.
signature.asc (application/pgp-signature, 833 B)