Getting Data In
Highlighted

How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

New Member

I am trying to deploy apps from a *nix Deployment Server to a Windows client. When the app folders are pulled down, the Local System account (which the forwarder service is running as) does not have permissions on the folders.

I believe this is a similar "ACL translation" issue to what other folks have seen deploying from Windows to *nix. I have to manually replace the permissions on the app folders with inherited ones after any change to an app. Has anyone seen this before or come up with a solution?

0 Karma
Highlighted

Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

Splunk Employee
Splunk Employee

I am pretty sure you are hitting a bug:

SPL-108564
Windows specific, apps pushed to client from deployment server to not inherit parent directory permissions. This is still an outstanding issue.

Please open a Support Case and reference this issue if it needs further investigation.

Okie

View solution in original post

Highlighted

Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

New Member

Awesome, thanks! I'll look into this.

0 Karma
Highlighted

Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

Communicator

I was told also SPL-109430 (in addition to SPL-108564) are assigned to track this issue.

0 Karma
Highlighted

Re: How to handle app folder permissions when deploying apps from a *Nix Deployment Server to Windows deployment clients?

Explorer

This is still an open issue as of Splunk 6.5.0 http://docs.splunk.com/Documentation/Splunk/6.5.0/ReleaseNotes/KnownIssues

As a workaround you can run the command below to restore the inheritance. It leaves the explicit permission assignments that splunkd does as part of the deployment process in place so it should be low risk. I have been using a this command at the C:\Program Files\Splunk level so it covers other locations, like the log directories and frozen index directories, as well. It can take a while to run if you include the whole Splunk directory so adapt to suit your needs.

icacls.exe "C:\Program Files\Splunk\etc\apps" /inheritance:e /T

You can use the /reset option of the icacls to restore the inheritance and remove the explicit permission assignments but I haven't tested the impact of that.

This is the same issue as https://answers.splunk.com/answers/250970/why-does-splunkd-change-ntfs-permissions.html

0 Karma