[Resume] Improve ownership and permissions of files in OpenSearch/Dashboards deb and rpm packages

[peterzhuamazon]

Description

[Resume] Improve ownership and permissions of files in OpenSearch/Dashboards deb and rpm packages
Originally commit by @smortex on #3898 #3952 #4038.

Issues Resolved

#3815 (comment)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.16%. Comparing base (78fd2fd) to head (37b2b68).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4043   +/-   ##
=======================================
  Coverage   92.16%   92.16%           
=======================================
  Files         192      192           
  Lines        6282     6282           
=======================================
  Hits         5790     5790           
  Misses        492      492           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[peterzhuamazon]

Thinking if we need to make some adjustment so that 1.x is not picking this change, but 2.x and higher will take this change.

cc: @smortex @bbarani

Thanks.

[peterzhuamazon]

Before:
drwxr-xr-x 9 opensearch opensearch 4096 Mar 13 21:22 opensearch/

After:
drwxr-x--- 9 opensearch opensearch 4096 Mar 13 21:23 opensearch/

[peterzhuamazon]

Thinking if we need to make some adjustment so that 1.x is not picking this change, but 2.x and higher will take this change.

cc: @smortex @bbarani

Thanks.

I will setup the changes so that 1.x becomes legacy and new changes goes to current in another PR.

[peterzhuamazon]

Start more testing:

PermissionError: [Errno 13] Permission denied: '/etc/opensearch/opensearch.yml'

shutil.Error: [('/usr/share/opensearch/logs/opensearchcluster1_index_indexing_slowlog.json', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_index_indexing_slowlog.json', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_index_indexing_slowlog.json'"), ('/usr/share/opensearch/logs/opensearchcluster1_deprecation.json', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_deprecation.json', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_deprecation.json'"), ('/usr/share/opensearch/logs/opensearchcluster1_task_detailslog.json', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_task_detailslog.json', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_task_detailslog.json'"), ('/usr/share/opensearch/logs/opensearchcluster1_index_search_slowlog.log', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_index_search_slowlog.log', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_index_search_slowlog.log'"), ('/usr/share/opensearch/logs/opensearchcluster1_server.json', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_server.json', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_server.json'"), ('/usr/share/opensearch/logs/opensearchcluster1_task_detailslog.log', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_task_detailslog.log', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_task_detailslog.log'"), ('/usr/share/opensearch/logs/opensearchcluster1_index_indexing_slowlog.log', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_index_indexing_slowlog.log', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_index_indexing_slowlog.log'"), ('/usr/share/opensearch/logs/opensearchcluster1.log', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1.log', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1.log'"), ('/usr/share/opensearch/logs/opensearchcluster1_deprecation.log', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_deprecation.log', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_deprecation.log'"), ('/usr/share/opensearch/logs/opensearchcluster1_index_search_slowlog.json', '/home/ubuntu/opensearch-build/test-results/51b0ac26b45942d8a81f982d373bf8ec/integ-test/geospatial/with-security/local-cluster-logs/id-0/opensearch-service-logs/opensearchcluster1_index_search_slowlog.json', "[Errno 13] Permission denied: '/usr/share/opensearch/logs/opensearchcluster1_index_search_slowlog.json'")]

[peterzhuamazon]

Will send the changes of the integTest in another PR:

• Support new deb/rpm permissions changes in #4043 on integTest #4534

2024-03-14 20:39:36 INFO     | geospatial           | with-security        | PASS  |
2024-03-14 20:39:36 INFO     | geospatial           | without-security     | PASS  |

[roock]

Not sure this is the right place to add this, but please note that the ownership change isn't fully reflected when upgrading opensearch package. ownership for files are correctly set to root, but directory are still owned by opensearch.

Our system: Debian 12, installation via apt package.

Upgrade from 2.12:

$ ls -la
total 324
drwxr-xr-x  8 opensearch opensearch   4096 16. Apr 16:24 .
drwxr-xr-x 96 root       root         4096 28. Mär 13:46 ..
drwxr-xr-x  3 opensearch opensearch   4096 12. Apr 11:22 bin
lrwxrwxrwx  1 opensearch opensearch     19 14. Okt 2022  data -> /var/lib/opensearch
drwxr-xr-x  9 opensearch opensearch   4096 12. Apr 11:22 jdk
drwxr-xr-x  3 opensearch opensearch  12288 12. Apr 11:22 lib
lrwxrwxrwx  1 opensearch opensearch     19 14. Okt 2022  logs -> /var/log/opensearch
-rw-r--r--  1 root       root         8610 14. Okt 2022  manifest.yml
drwxr-xr-x 22 opensearch opensearch   4096 12. Apr 11:22 modules
-rw-r--r--  1 root       root       273938 14. Okt 2022  NOTICE.txt
drwxr-xr-x  5 opensearch opensearch   4096 28. Mär 13:46 performance-analyzer-rca
drwxr-xr-x 24 opensearch opensearch   4096 12. Apr 14:13 plugins
-rw-r--r--  1 root       root         3699 14. Okt 2022  README.md

New installation with 2.13

$ ls -al /usr/share/opensearch/
total 316
drwxr-xr-x  8 root root   4096 25. Apr 10:38 .
drwxr-xr-x 94 root root   4096 25. Apr 10:38 ..
drwxr-xr-x  3 root root   4096 25. Apr 10:38 bin
lrwxrwxrwx  1 root root     19 14. Okt 2022  data -> /var/lib/opensearch
drwxr-xr-x  9 root root   4096 25. Apr 10:38 jdk
drwxr-xr-x  3 root root   4096 25. Apr 10:38 lib
lrwxrwxrwx  1 root root     19 14. Okt 2022  logs -> /var/log/opensearch
-rw-r--r--  1 root root   8610 14. Okt 2022  manifest.yml
drwxr-xr-x 22 root root   4096 25. Apr 10:38 modules
-rw-r--r--  1 root root 273938 14. Okt 2022  NOTICE.txt
drwxr-xr-x  5 root root   4096 25. Apr 10:38 performance-analyzer-rca
drwxr-xr-x 23 root root   4096 25. Apr 10:38 plugins
-rw-r--r--  1 root root   3699 14. Okt 2022  README.md