18146 omd create: Distinguish failures by exit status

SUP-24001

Change-Id: Ibe3b21e80881c8f922dee9337279116067118b82

Author: SoloJacobs

.werks/18146.md

@@ -0,0 +1,21 @@
+[//]: # (werk v2)
+# omd create: Detect if crontab cannot be accessed
+
+key        | value
+---------- | ---
+date       | 2025-06-26T09:30:35+00:00
+version    | 2.4.0p7
+class      | feature
+edition    | cre
+component  | omd
+level      | 1
+compatible | yes
+
+With this Werk, `omd create` will emit different exit codes based on errors it encountered:
+
+0 -> Site creation was successful.
+1 -> An exception occured and the site creation was aborted.
+2 -> An issue was detected that requires manual intervention to resolve.
+
+Currently, the exit code 2 case is only triggered when a site user is unable to access `crontab`, which is required for a site to work properly.
+

omd/packages/omd/omdlib/main.py

@@ -9,6 +9,7 @@
 
 import abc
 import contextlib
+import enum
 import errno
 import fcntl
 import io
@@ -2034,6 +2035,19 @@ def use_update_alternatives() -> bool:
     return os.path.exists("/var/lib/dpkg/alternatives/omd")
 
 
+def _crontab_access() -> bool:
+    return (
+        subprocess.run(
+            ["crontab", "-e"],
+            env={"VISUAL": "true", "EDITOR": "true"},
+            check=False,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        ).returncode
+        == 0
+    )
+
+
 def main_create(
     version_info: VersionInfo,
     site: SiteContext,
@@ -2218,13 +2232,19 @@ def finalize_site(
 
             # avoid executing hook 'TMPFS' and cleaning an initialized tmp directory
             # see CMK-3067
-            finalize_site_as_user(version_info, site, command_type, ignored_hooks=["TMPFS"])
-            sys.exit(0)
+            outcome = finalize_site_as_user(
+                version_info, site, command_type, ignored_hooks=["TMPFS"]
+            )
+            sys.exit(outcome.value)
         except Exception as e:
-            bail_out("Failed to finalize site: %s" % e)
+            sys.stderr.write(f"Failed to finalize site: {e}\n")
+            sys.exit(FinalizeOutcome.ABORTED.value)
     else:
         _wpid, status = os.waitpid(pid, 0)
-        if status:
+        if (
+            not os.WIFEXITED(status)
+            or (outcome := FinalizeOutcome(os.WEXITSTATUS(status))) is FinalizeOutcome.ABORTED
+        ):
             bail_out("Error in non-priviledged sub-process.")
 
     # The config changes above, made with the site user, have to be also available for
@@ -2241,14 +2261,21 @@ def finalize_site(
         apache_reload,
         verbose=verbose,
     )
+    sys.exit(outcome.value)
+
+
+class FinalizeOutcome(enum.Enum):
+    OK = 0
+    ABORTED = 1
+    WARN = 2
 
 
 def finalize_site_as_user(
     version_info: VersionInfo,
     site: SiteContext,
     command_type: CommandType,
     ignored_hooks: list[str] | None = None,
-) -> None:
+) -> FinalizeOutcome:
     # Mount and create contents of tmpfs. This must be done as normal
     # user. We also could do this at 'omd start', but this might confuse
     # users. They could create files below tmp which would be shadowed
@@ -2268,6 +2295,10 @@ def finalize_site_as_user(
         save_instance_id(file_path=get_instance_id_file_path(Path(site.dir)), instance_id=uuid4())
 
     call_scripts(site, "post-" + command_type.short, open_pty=sys.stdout.isatty())
+    if not _crontab_access():
+        sys.stderr.write("Warning: site user cannot access crontab\n")
+        return FinalizeOutcome.WARN
+    return FinalizeOutcome.OK
 
 
 def main_rm(