Page MenuHomePhabricator

Configuration files are kept in the system when VyOS config is commited but not saved
Open, Requires assessmentPublicBUG

Description

T769 has drawn attention to a much larger issue than its own scope. It would be reasonable to expect that if configuration for some service is not present in the VyOS config, a config file for the target application should not be present in the system either. In reality, it's not the case.

Most scripts remove configuration files when their node is deleted from the VyOS config. However, there's no mechanism that would remove those files if configuration was not deleted from the config, but has gone from it, typically because the user forgot to save the config before rebooting.

Simplest reproducing procedure:

  1. set service ssh
  2. commit
  3. exit
  4. reboot
  5. After reboot, /etc/ssh/sshd_config is there

If a service is configured to start on boot (in most cases it shouldn't, but as T769 showed, it does happen), it may cause unconfigured services come back from the dead.

Since config scripts that delete unneeded files cannot run unless triggered by actual deletion, the only way to fix this is to identify all files managed by VyOS and run a script that removes them at boot time, before config is loaded.

Details

Difficulty level
Normal (likely a few hours)
Version
1.2.0
Why the issue appeared?
Will be filled on close

Event Timeline

dmbaturin created this task.Dec 3 2018, 1:51 AM
pasik added a subscriber: pasik.Mar 12 2019, 6:08 PM
thinkl33t added a subscriber: thinkl33t.EditedJun 13 2019, 4:36 PM

Could we work around this by implementing an overlay for every commit, with the entire stack of overlays being combined with the root overlay when a save is issued?