config path: robustly remove config serials with read-only dirs

Since 2.5.0b1 every config activation snapshots $OMD_ROOT/local into
the new helper config serial (helper_config/<serial>/local). The copy
is made with shutil.copytree, which preserves permission bits.

On sites where the local/ hierarchy is intentionally read-only (e.g.
because it is distributed centrally), the snapshot therefore contains
directories without write permission. The next cleanup_old_configs run
then crashes with PermissionError when removing an outdated serial,
because on POSIX a directory must be writable to unlink its children.
This aborts config activation.

Restore permissions on the directories of the serial's tree and retry
when the removal hits a PermissionError. Only directory permissions
matter for deletion; symlinks are skipped so no permissions outside
the tree can be changed. Use the same robust removal for the stale
under-construction serial in create(), which has the same failure
mode.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: dsrink

packages/cmk-ccc/cmk/ccc/config_path.py

@@ -93,6 +93,27 @@ def _increment_to_next_serial(base: Path) -> int:
     return new_serial
 
 
+def _rmtree_robust(path: Path) -> None:
+    """Remove a tree even if directory write permissions were removed externally.
+
+    Some deployments strip write permissions from the distributed site tree.
+    On POSIX, only the permissions of the *directories* matter for deletion,
+    so restore them and retry.
+    """
+    try:
+        shutil.rmtree(path)
+    except PermissionError:
+        path.chmod(0o700)
+        for dirpath, dirnames, _filenames in path.walk():
+            for dirname in dirnames:
+                subdir = dirpath / dirname
+                # Don't follow symlinks: we must not change permissions
+                # outside the tree.  The symlink itself is simply unlinked.
+                if not subdir.is_symlink():
+                    subdir.chmod(0o700)
+        shutil.rmtree(path)
+
+
 def cleanup_old_configs(base: Path) -> None:
     root = VersionedConfigPath.make_root_path(base)
     if not root.exists():
@@ -123,7 +144,7 @@ def cleanup_old_configs(base: Path) -> None:
             count_kept_serials += 1
             continue
 
-        shutil.rmtree(serial.path)
+        _rmtree_robust(serial.path)
 
 
 @contextmanager
@@ -138,7 +159,7 @@ def create(base: Path) -> Iterator[ConfigCreationContext]:
 
     with suppress(FileNotFoundError):
         # this should not exist, but we must be robust.
-        shutil.rmtree(under_construction_path)
+        _rmtree_robust(under_construction_path)
     under_construction_path.mkdir(parents=True, exist_ok=False)
 
     yield ConfigCreationContext(

packages/cmk-ccc/tests/test_config_path.py

@@ -193,6 +193,30 @@ def test_integration_with_create(self, tmp_path: Path) -> None:
         assert (root / "latest").is_symlink()
         assert (root / "serial.mk").exists()
 
+    def test_removal_of_readonly_serial(self, tmp_path: Path) -> None:
+        """Old serials must be removed even if they contain read-only directories.
+
+        The `local` snapshot inside a serial dir preserves the permissions of
+        `$OMD_ROOT/local`, which may be read-only (e.g. distributed setups).
+        """
+        root, _ = self._make_helper_config(tmp_path, serials=[1, 2, 3], latest_serial=3)
+        local = root / "1" / "local"
+        plugins = local / "lib" / "plugins"
+        plugins.mkdir(parents=True)
+        (plugins / "check").touch()
+        unreadable = local / "share"
+        unreadable.mkdir()
+        (unreadable / "file.mk").touch()
+        unreadable.chmod(0o000)
+        for directory in (plugins, local / "lib", local, root / "1"):
+            directory.chmod(0o555)
+
+        cleanup_old_configs(tmp_path)
+
+        assert not (root / "1").exists()
+        assert (root / "2").exists()
+        assert (root / "3").exists()
+
     def test_proper_sorting(self, tmp_path: Path) -> None:
         """Serial directories must be sorted numerically, not lexically."""
         root, _ = self._make_helper_config(tmp_path, serials=[1, 5, 7, 12, 23], latest_serial=23)