Re: Could not load requested further augments from file

So, there were two issues:


   1. AVCs on an augments file in /srv that selinux was blocking access to.
   2. Typo in host_specific.json.  Turns out cfe doesn't recognize 
   host_specfic.json.


Rather than fiddling with selinux contexts  I moved the augments file in 
/srv to host_specific.json and updated def.json to use the variables from 
host_specific.json.

Thank you all for your help.
On Monday, August 19, 2024 at 8:15:52 AM UTC-5 [email protected] 
wrote:

> Yes, I introduced the idea that the docs are "imprecise" because I got 
> lucky enough to choose the ONE non-sys variable which is available in 
> augments for expansion: def.jq which is the only non-sys non-const variable 
> which is defined in the agent aka C-code as can be seen with this command 
> to show all variables and filter out sys and const variables:
>
> $ cf-promises --show-vars | grep "source=agent" | grep -v sys | grep -v 
> const default:def.jq jq --compact-output --monochrome-output --ascii-output 
> --unbuffered --sort-keys invocation,source=agent,command_name=jq 
>
> So as Vrata mentioned, you are likely running into an SELinux issue.
>
> -Craig
>
> On Monday, August 19, 2024 at 1:12:25 AM UTC-5 [email protected] 
> wrote:
>
>> Hello, 
>>
>> On Fri, 2024-08-16 at 14:06 -0700, Beto wrote: 
>> > Weird thing is this occurs ONLY on RHEL8, not on RHEL7 and  this same 
>> augments configuration has been in use for years. 
>> That suggests the difference is most likely SELinux. Does it happen even 
>> if you 
>> do a manual agent run from an interactive shell with `cf-agent -KI`? If 
>> not, 
>> please double-check `ausearch -m AVC` on an affected system. 
>>
>> Another alternative is to run `strace -ff -- cf-agent -KI 2> 
>> cf-agent.strace`, 
>> look for the particular file name in the trace and see what happens when 
>> the 
>> file is attempted to be opened and read. 
>>
>> > 
>> > I thought maybe I could use host_specific.json to get around this issue 
>> but I can't tell that host_specific.json is being seen at all (as you say 
>> the doc is "imprecise"). 
>> What do you think is imprecise in the docs? I think it's quite clear: 
>>
>> There are two canonical augments files, host_specific.json, and def.json 
>> which may load additional Augments as specified by the augments key. 
>>
>> Notes: 
>> CFEngine variables are not expanded unless otherwise noted. 
>>
>> and then there is a note for the def.json file: 
>>
>> sys variables are expanded in def.json and all subsequently loaded 
>> augments 
>> as specified by the augments key. 
>>
>> You can do a verbose agent run using `--verbose` to see details of what 
>> it is doing 
>> and which files it is loading. 
>>
>> One thing is quite clear -- the error message that further augments could 
>> not be 
>> loaded should be enhanced to explain why. 
>>
>> -- 
>> Vratislav 
>>
>> > 
>> > On Friday, August 16, 2024 at 4:00:51 PM UTC-5 Beto wrote: 
>> > > There are no selinux AVCs logged. 
>> > > 
>> > > On Friday, August 16, 2024 at 3:42:41 PM UTC-5 
>> [email protected] wrote: 
>> > > > Def.jq might itself be special what about def.foo?  
>> > > > 
>> > > > On Fri, Aug 16, 2024, 3:10 PM '[email protected]' via 
>> help-cfengine <[email protected]> wrote: 
>> > > > > The docs might be a bit imprecise. 
>> https://docs.cfengine.com/docs/3.24/reference-language-concepts-augments.html 
>> says in two separate notes: 
>> > > > > 
>> > > > >  * CFEngine variables are not expanded unless otherwise noted. 
>> > > > >  * sys variables are expanded in def.json and all subsequently 
>> loaded augments as specified by the augments key. 
>> > > > > --- 
>> > > > > 
>> > > > > I did a little test and it does seem your def.network and sys 
>> variables should both be expanded so I wonder if it is an access or selinux 
>> issue? 
>> > > > > 
>> > > > > Maybe check /var/log/audit/audit.log for cf-serverd related 
>> entries? 
>> > > > > 
>> > > > > --- 
>> > > > > 
>> > > > > My test: 
>> > > > > $ cat def.json  
>> > > > > { 
>> > > > >   "vars": { 
>> > > > >     "foo": "${def.jq}", 
>> > > > >     "bar": "baz" 
>> > > > >   } 
>> > > > > } 
>> > > > > 
>> > > > > $ cat t.cf  
>> > > > > bundle agent main 
>> > > > > { 
>> > > > >   reports: 
>> > > > >  "foo is ${default:def.foo}"; 
>> > > > >  "bar is ${default:def.bar}"; 
>> > > > >  "def.jq is ${def.jq}"; 
>> > > > > } 
>> > > > > 
>> > > > > result: 
>> > > > > R: foo is jq --compact-output --monochrome-output --ascii-output 
>> --unbuffered --sort-keys 
>> > > > > R: bar is baz 
>> > > > > R: def.jq is jq --compact-output --monochrome-output 
>> --ascii-output --unbuffered --sort-keys 
>> > > > > On Friday, August 16, 2024 at 2:57:53 PM UTC-5 Nick Anderson 
>> wrote: 
>> > > > > > I dont think you can use non sys variables in augments like 
>> that becuase augmwnts is loaded before policy is read at all. Check the 
>> augments docs (i can't atm, on the move).  
>> > > > > > 
>> > > > > > On Fri, Aug 16, 2024, 1:43 PM Beto <[email protected]> wrote: 
>> > > > > > > As we upgrade from RHEL7 to RHEL8 I'm seeing this in 
>> /var/log/messages: 
>> > > > > > > 
>> > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server) 
>>  Rereading policy file '/var/cfengine/inputs/promises.cf' 
>> > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]:   error: Could not 
>> load requested further augments from file '/srv/sysadmin/etc/ 
>> > > > > > > cfengine/augments.json' 
>> > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]:   error: Could not 
>> load requested further augments from file '$(sys.inputdir)/au 
>> > > > > > > gments/augments_$(def.network).json' 
>> > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server) 
>>  Could not load requested further augments from file '/srv/sysa 
>> > > > > > > dmin/etc/cfengine/augments.json' 
>> > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server) 
>>  Could not load requested further augments from file '$(sys.inp 
>> > > > > > > utdir)/augments/augments_$(def.network).json' 
>> > > > > > > 
>> > > > > > > Not seeing this on RHEL7. 
>> > > > > > > 
>> > > > > > > CFEngine Core 3.24.0 
>> > > > > > > CFEngine Enterprise 3.24.0 
>> > > > > > > 
>> > > > > > > Any ideas? 
>> > > > > > > -- 
>> > > > > > > You received this message because you are subscribed to the 
>> Google Groups "help-cfengine" group. 
>> > > > > > > To unsubscribe from this group and stop receiving emails from 
>> it, send an email to [email protected]. 
>> > > > > > > To view this discussion on the web visit 
>> https://groups.google.com/d/msgid/help-cfengine/857f33e7-4ac3-45f1-8b90-234de4c98bc8n%40googlegroups.com. 
>>
>>
>>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/4035b131-5b0f-438b-97bb-6a01b58cf6ean%40googlegroups.com.