topic Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients? in Getting Data In

How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

jwhathaway — Thu, 09 Jun 2016 17:53:38 GMT

I am trying to deploy apps from a *nix Deployment Server to a Windows client. When the app folders are pulled down, the Local System account (which the forwarder service is running as) does not have permissions on the folders.

I believe this is a similar "ACL translation" issue to what other folks have seen deploying from Windows to *nix. I have to manually replace the permissions on the app folders with inherited ones after any change to an app. Has anyone seen this before or come up with a solution?

Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

jwelch_splunk — Thu, 09 Jun 2016 20:37:37 GMT

I am pretty sure you are hitting a bug:

SPL-108564
Windows specific, apps pushed to client from deployment server to not inherit parent directory permissions. This is still an outstanding issue.

Please open a Support Case and reference this issue if it needs further investigation.

Okie

Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

jwhathaway — Thu, 09 Jun 2016 20:52:35 GMT

Awesome, thanks! I'll look into this.

Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

ChrisBell04 — Thu, 04 Aug 2016 22:58:58 GMT

I was told also SPL-109430 (in addition to SPL-108564) are assigned to track this issue.

Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

martinho — Mon, 07 Nov 2016 05:25:56 GMT

This is still an open issue as of Splunk 6.5.0 http://docs.splunk.com/Documentation/Splunk/6.5.0/ReleaseNotes/KnownIssues

As a workaround you can run the command below to restore the inheritance. It leaves the explicit permission assignments that splunkd does as part of the deployment process in place so it should be low risk. I have been using a this command at the C:\Program Files\Splunk level so it covers other locations, like the log directories and frozen index directories, as well. It can take a while to run if you include the whole Splunk directory so adapt to suit your needs.

icacls.exe "C:\Program Files\Splunk\etc\apps" /inheritance:e /T

You can use the /reset option of the icacls to restore the inheritance and remove the explicit permission assignments but I haven't tested the impact of that.

This is the same issue as https://answers.splunk.com/answers/250970/why-does-splunkd-change-ntfs-permissions.html