Getting Data In

How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

jwhathaway
New Member

I am trying to deploy apps from a *nix Deployment Server to a Windows client. When the app folders are pulled down, the Local System account (which the forwarder service is running as) does not have permissions on the folders.

I believe this is a similar "ACL translation" issue to what other folks have seen deploying from Windows to *nix. I have to manually replace the permissions on the app folders with inherited ones after any change to an app. Has anyone seen this before or come up with a solution?

0 Karma
1 Solution

jwelch_splunk
Splunk Employee
Splunk Employee

I am pretty sure you are hitting a bug:

SPL-108564
Windows specific, apps pushed to client from deployment server to not inherit parent directory permissions. This is still an outstanding issue.

Please open a Support Case and reference this issue if it needs further investigation.

Okie

View solution in original post

martinho
Explorer

This is still an open issue as of Splunk 6.5.0 http://docs.splunk.com/Documentation/Splunk/6.5.0/ReleaseNotes/KnownIssues

As a workaround you can run the command below to restore the inheritance. It leaves the explicit permission assignments that splunkd does as part of the deployment process in place so it should be low risk. I have been using a this command at the C:\Program Files\Splunk level so it covers other locations, like the log directories and frozen index directories, as well. It can take a while to run if you include the whole Splunk directory so adapt to suit your needs.

icacls.exe "C:\Program Files\Splunk\etc\apps" /inheritance:e /T

You can use the /reset option of the icacls to restore the inheritance and remove the explicit permission assignments but I haven't tested the impact of that.

This is the same issue as https://answers.splunk.com/answers/250970/why-does-splunkd-change-ntfs-permissions.html

0 Karma

jwelch_splunk
Splunk Employee
Splunk Employee

I am pretty sure you are hitting a bug:

SPL-108564
Windows specific, apps pushed to client from deployment server to not inherit parent directory permissions. This is still an outstanding issue.

Please open a Support Case and reference this issue if it needs further investigation.

Okie

jwhathaway
New Member

Awesome, thanks! I'll look into this.

0 Karma

ChrisBell04
Communicator

I was told also SPL-109430 (in addition to SPL-108564) are assigned to track this issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...