RHBA-2015:0440 - Bug Fix Advisory

Topic

Updated pacemaker packages that fix numerous bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

Description

The Pacemaker Resource Manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure.

The pacemaker packages have been upgraded to upstream version 1.1.12, which provides a number of bug fixes and enhancements over the previous version. The notable changes are:

• Access Control Lists (ACLs) are checked prior to making an update.
• The default ACL support and support for nodes and UNIX groups have been added.
• A more efficient XML patch set format has been enabled.
• The zero-copy status update has been implemented.
• All read and write operations are sent via the cluster connection and all nodes can process them.
• The "cluster-name" property is set to the corosync "cluster_name" property by default.
• Daemons always get a log file, unless explicitly configured not to.
• A node is automatically re-unfenced if the fencing device definition changes.
• Resource sets and templates for location constraints are now allowed.
• Per-resource maintenance mode is supported.
• Anti-colocation between resources is now strictly enforced when the resources are being moved.
• Resources that require unfencing are supported.
• Instances are not promoted when the quorum is lost and the "no-quorum-policy" variable is set to "freeze".
• The role colocation with the -INFINITY variable is enforced. - Unrelated resources with a common colocation target remain promoted.
• Members of cloned groups are stopped when dependencies are stopped.
• Native D-Bus library for systemd and upstart support is used.
• Invalid transition is prevented when a resource is ordered to start after the container the resource started in. (BZ#1059626)

This update also fixes the following bugs:

• The crm_resource utility contained an insufficient check for determining the state of grouped master/slave resources. Consequently, the resources were not considered to be running, and the administrator was unable to move the resources to a new location. The check has been improved, and the administrator is now able to manually move grouped master/slave resources around the cluster when they are running. (BZ#1067544)
• Child processes responsible for running resource operations inherited the direction to ignore a SIGPIPE signal from the parent process. Consequently, numerous error logs regarding broken pipes were returned. The child processes have been modified to not ignore SIGPIPE, and the error logs are no longer produced. (BZ#1081240)
• The systemd API triggered immediately after a "start" action was initiated by the pacemaker utility, rather than when the action was completed. Consequently, processes that depend on the completion of the "start" action were initiated but failed. Now, pacemaker polls the systemd API until the service enters the "active" state or until a pre-configured timeout is reached. As a result, processes dependent on the completion of "start" now execute as expected. (BZ#1111747)
• The dbus client API could become unable to process handling responses. This caused the systemd resource management to fail and the managed resources to become unresponsive. With this update, the dbus connection to systemd remains stable, and no longer leads to unresponsive resources. (BZ#1139701)

In addition, this update adds the following enhancements:

• Unfencing is now automatically performed when devices are added or modified after the cluster was running on a node. This ensures that the data is protected from corruption. (BZ#1078078)
• With this update, the Open Clustering Framework (OCF) agents provide a text message explaining the reason for a failure of an agent. (BZ#1128931)

Users of pacemaker are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux High Availability for x86_64 7 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 7 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux High Availability (for RHEL Server) from RHUI 7 x86_64
• Red Hat Enterprise Linux Resilient Storage (for RHEL Server) from RHUI 7 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux High Availability for x86_64 - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Resilient Storage for x86_64 - Extended Life Cycle Support 7 x86_64

Fixes

• BZ - 1069799 - Under certain circumstances pacemaker can create node entries for unknown nodes
• BZ - 1081240 - Filesystem resource spamming logs with fs-090_monitor_20000:15108:stderr [ cut: write error: Broken pipe ]
• BZ - 1085451 - property stonith-enabled=false bug behavior
• BZ - 1097457 - order constraint between remote-node and resource causes invalid transition
• BZ - 1111747 - Pacemaker doesn't wait for systemd resource start
• BZ - 1127289 - core dumped: stonith-ng[21398]: error: crm_abort: crm_glib_handler: Forked child 12188 to record non-fatal assert at logging.c:73 : Source ID 132 was not found when attempting to remove it
• BZ - 1128931 - add OCF exit reason string support
• BZ - 1133952 - [abrt] pacemaker: crm_abort(): stonithd killed by SIGABRT
• BZ - 1135913 - cibadmin writes the CIB to disk even if the CIB was not changed when using CIB_file
• BZ - 1139701 - systemd resources operations timeout and get unmanaged
• BZ - 1165423 - Pacemaker doesn't wait for systemd resource stop
• BZ - 1174462 - RFE: remove 1M message size limit
• BZ - 1176210 - advanced usage of clone ordering constraints with interleave=true

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal