From 41f840ee851ec4157fa2af3aaf9d61cdafec3459 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Tue, 2 Jun 2026 21:00:20 +1000 Subject: [PATCH] fix(setup): grant spinifex-vpcd sudo for ovn-appctl (siv-167) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The W2 inject-garp fix landed in 72a6a59d adds a shellout to `ovn-appctl -t ovn-controller inject-garp ` via the L0 execRunner, which prefixes `sudo` when not running as root. spinifex-vpcd runs as user spinifex-vpcd, so every emission was hitting `sudo: a password is required` and silently returning a WARN that nobody read until W5 diag capture surfaced the journal. Net: W2 has been a complete no-op since it shipped. Every recycled-EIP scenario has continued to leave stale upstream ARP. Evidence: diag bundle from run 26813235295 — 12/12 GARP attempts denied by sudo, 0 successful emissions; pcap shows runner ARP for recycled EIP .232 stuck on the prior VPC's gw chassisredirect MAC (02:75:d9:ef:d8:4b) while OVN NB has handed .232 to a new VPC with a different gw MAC; pcap also shows runner sending 174 SYNs to recycled EIP .233 with 0 SYN+ACKs received. Fix: add /usr/bin/ovn-appctl to the spinifex-vpcd NOPASSWD grant. Trivial; ovn-appctl is already trusted via the existing NB/SB read-write grants. Follow-ups (separate change): tighten host.InjectGARP error classification so sudo-deny is loud (Error or fatal) rather than silently warn-and-continue; add a boot-time self-check that verifies sudo permissions for every host-tool the daemon will shell out to. --- scripts/setup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/setup.sh b/scripts/setup.sh index 399dbf8ec..b2bd5111a 100755 --- a/scripts/setup.sh +++ b/scripts/setup.sh @@ -192,7 +192,7 @@ spinifex-daemon ALL=(root) NOPASSWD: /usr/bin/ovn-nbctl set NB_Global . ipsec=tr # Spinifex VPC daemon: OVN and OVS read/write, OVN controller status check and DHCP spinifex-vpcd ALL=(root) NOPASSWD: /usr/sbin/dhcpcd spinifex-vpcd ALL=(root) NOPASSWD: /usr/bin/ovs-vsctl, /usr/bin/ovs-appctl -spinifex-vpcd ALL=(root) NOPASSWD: /usr/bin/ovn-nbctl, /usr/bin/ovn-sbctl +spinifex-vpcd ALL=(root) NOPASSWD: /usr/bin/ovn-nbctl, /usr/bin/ovn-sbctl, /usr/bin/ovn-appctl spinifex-vpcd ALL=(root) NOPASSWD: /usr/bin/systemctl is-active --quiet ovn-controller spinifex-vpcd ALL=(root) NOPASSWD: /sbin/ip, /usr/sbin/ip SUDOERS