Improve error message if data dir on tbot and tctl not available for permissions#14282
Improve error message if data dir on tbot and tctl not available for permissions#14282stevenGravy merged 15 commits intomasterfrom
Conversation
… loading /var/lib/teleport dir
| return nil, trace.Wrap(err, fmt.Sprintf("Could not load Teleport host UUID file at %s. "+ | ||
| "Please make sure that Teleport is up and running prior to using tctl.", | ||
| filepath.Join(cfg.DataDir, utils.HostUUIDFile))) | ||
| } else if errors.Is(err, fs.ErrPermission) { |
There was a problem hiding this comment.
A couple comments:
- Why the inconsistency? In
tbotwe are logging an enhanced error message, but returning the original error unmodified. Intctlwe are wrapping the original error with a better message. Can we be consistent and take the same approach in both places? - You shouldn't need to use
fmt.Sprintfhere.trace.Wrapalready supports this:trace.Wrap(err, "this is a message: %v", x)
There was a problem hiding this comment.
thanks @zmb3 I've made these consistent approaches and removed the unnecessary fmt.Sprintf. Please check when you can.
| log.Infof("Created directory %q", p) | ||
| } else if err != nil { | ||
| if errors.Is(err, fs.ErrPermission) { | ||
| log.Errorf("Teleport does not have permission to write to: %v. Ensure that you are running as a user with appropriate permissions.", p) |
There was a problem hiding this comment.
This might confuse a user, as you'll log the error here, but also return a [different] error, which will eventually also be logged.
In general you should handle an error either by logging it or returning it, but not both.
| } else if err != nil { | ||
| //This error permission can occur if unable to read into the data dir | ||
| if errors.Is(err, fs.ErrPermission) { | ||
| return trace.Wrap(err, "Teleport does not have permission to write to: %v. Ensure that you are running as a user with appropriate permissions.", p) |
There was a problem hiding this comment.
In this case, we weren't trying to write, so the error message is not correct.
I would say something like does not have permission to access %v.
There was a problem hiding this comment.
@zmb3 changed error message and applied other suggestions
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
|
@stevenGravy See the table below for backport results.
|
This matches the error message given in
teleport startfortctlandtbotwhen not running with access to data dir. This matches to similar message when runningteleport startCurrently:
Now
$ tctl users ls ERROR: Teleport does not have permission to read Teleport host UUID file at /var/lib/teleport/host_uuid. Ensure that you are running as a user with appropriate permissions. lstat /private/var/lib/teleport/host_uuid: permission denied $ tbot start --auth-server=server ERRO [TBOT] Teleport does not have permission to write to: /var/lib/teleport/bot. Ensure that you are running as a user with appropriate permissions. config/destination_directory.go:132 ERROR: stat /var/lib/teleport/bot: permission denied