39 lines
2.4 KiB
Markdown
39 lines
2.4 KiB
Markdown
# REPORT — v0.156.1: after a power cut the box clears up (R-1006, R-1008) (2026-10-14)
|
||
|
||
Evidence: felhom.eu `documentation/audits/power-cut-fixes-2026-10-14/` — the spike (C1 the night's leftover, C2 a killed
|
||
worker, C3 a real power cut, C4 a full disk), the 17 red-proofs.
|
||
|
||
## What the spike showed
|
||
|
||
- A power cut mid-backup leaves `vzdump-lxc-<vmid>-<date>.tar.dat` + `.tmp/` (root, in `/var/lib/vz/dump`); Proxmox never
|
||
lists it as a backup; nothing removes it; every later backup is skipped „not enough space".
|
||
- The dead vzdump task stays in Proxmox's active list ~30–60 s after the boot — long enough for the agent's start-up pass
|
||
to call it „genuinely in flight" (R-1008). Short, so R-1008's harm is small.
|
||
- A killed worker leaves `tar`/`zstd` writing into the `.tar.dat` for minutes, none named „vzdump" — the reason the root
|
||
helper checks open files, not only process names.
|
||
- On „No space left" vzdump removes its own partial (both paths): the preflight's sizing stays. But a full host root breaks
|
||
LVM's own metadata writes (a half-removed snapshot; the janitor cannot clear it — new row).
|
||
|
||
## 0.156.0 is superseded — do not vouch it
|
||
|
||
A background security review of the pushed 0.156.0 flagged „fail-open state drift": its in-flight rule compared a task's
|
||
wall-clock start with the kernel's `btime`, which moves when the clock is corrected after the boot (an NTP step after a
|
||
power cut) — a live backup could then look „from before the boot" and its lock be cleared. 0.156.1 uses Proxmox's own
|
||
liveness rule instead (the UPID's pid + pstart against `/proc/<pid>/stat` start tick and state; no clock), and fails safe
|
||
when this agent cannot see root's processes (PID 1 not visible).
|
||
|
||
## What changed
|
||
|
||
See `CHANGELOG.md` v0.156.0: `vzdumpInFlight` behind the one `BackupRunning`; `internal/vzpartial` at start-up and before
|
||
each backup; the root helper `felhom-vzdump-partial-clean` + one sudoers line + the bundle entry.
|
||
|
||
## Gates
|
||
|
||
`go build ./... && go vet` clean; `go test ./... -count=1` rc 0; `agent_gates.py` all OK; `visudo -cf` parsed OK; the
|
||
config bundle tests (55) and the helper's tests (21) pass. 17 mutations, 17 red.
|
||
|
||
## Next
|
||
|
||
Released: tag `v0.156.0`, binary sha256 `8db22788…`, bundle `a2160521…`, step bundle `0.156.0-step1` `8be2bb8f…`. Then the operator's vouch + floor, then the live proof on demo-hp (a cut mid-backup) and
|
||
delivery to Tester 1 and the N100.
|