Error in AIX agent uninstallation

[Rebits]

Wazuh version	Install type	Action performed	Platform
4.1.0-rev	Agent	Remove	5.3

Hello team,

There are some issues in the AIX agent uninstallation process.

If we uninstall an AIX agent we get the following error:

bash-4.4# rpm -e wazuh-agent             
rmdir of /var/ossec/tmp/src/init failed: No such file or directory
rmdir of /var/ossec/tmp/etc/templates/config/generic/localfile-logs failed: No such file or directory
rmdir of /var/ossec/tmp/etc/templates/config/generic failed: No such file or directory
rmdir of /var/ossec/tmp/etc/templates/config failed: No such file or directory
rmdir of /var/ossec/tmp/etc/templates failed: No such file or directory
cannot remove /var/ossec/queue/fim/db - directory not empty
cannot remove /var/ossec/queue/fim - directory not empty
cannot remove /var/ossec/queue - directory not empty
removal of /var/ossec/logs/ossec.json failed: No such file or directory
cannot remove /var/ossec/etc/shared - directory not empty
cannot remove /var/ossec/etc - directory not empty
cannot remove /var/ossec - directory not empty
var/opt/freeware/tmp/rpm-tmp.32064[14]: %posttrans:  not found

Resulting in /var/ossec/queue/fim/db/fim.db file not being deleted.

This produces an unclean uninstallation and it could cause some errors in future Wazuh installation, so, It should be necessary to fix the AIX agents uninstall process.

[c-bordon]

Update:

packages: https://packages-dev.wazuh.com/pre-release/aix/wazuh-agent-4.3.4-1.aix.ppc.rpm

bash-4.4# rpm -e wazuh-agent
rmdir of /var/ossec/tmp/src/init failed: No such file or directory
rmdir of /var/ossec/tmp/etc/templates/config/generic/localfile-logs failed: No such file or directory
rmdir of /var/ossec/tmp/etc/templates/config/generic failed: No such file or directory
rmdir of /var/ossec/tmp/etc/templates/config failed: No such file or directory
rmdir of /var/ossec/tmp/etc/templates failed: No such file or directory
cannot remove /var/ossec/queue/syscollector/db - directory not empty
cannot remove /var/ossec/queue/syscollector - directory not empty
cannot remove /var/ossec/queue/logcollector - directory not empty
cannot remove /var/ossec/queue/fim/db - directory not empty
cannot remove /var/ossec/queue/fim - directory not empty
cannot remove /var/ossec/queue - directory not empty
removal of /var/ossec/logs/ossec.json failed: No such file or directory
cannot remove /var/ossec/etc/shared - directory not empty
cannot remove /var/ossec/etc - directory not empty
cannot remove /var/ossec - directory not empty

[jotacarma90]

Analysis

After doing some research on how the packages and SPECS work, there are two important points related to this issue:

• %files: This list is all the directories/files that are going to be created during package installation, and therefore automatically, during package uninstallation (rpm -e), an rmdir will be generated for each of them. (At this point, we assume that those directories must be empty, and exist).
• %preun: This is the script that is used in the pre-uninstallation, what we are looking to do here, is to empty completely the content of all the directories mentioned in %files.

Therefore, the errors that are shown:

• rmdir of XXX failed: No such file or directory:
  Indicates that this directory exists in the %files block, but has been deleted before uninstalling the package. Easy to avoid this errors adding: %config(missingok) in every file/directory that we want to ignore if it no exists during uninstallation (we should review this).

• cannot remove XXX - directory not empty:
  The directory contains files, so it is necessary to empty them. The change we are going to introduce is to use a find to remove all the files in those directories in the %preun:

%preun

if [ $1 = 0 ]; then

  /etc/rc.d/init.d/wazuh-agent stop > /dev/null 2>&1 || :
  find %{_localstatedir}/queue -type f -exec rm -f {} \; || :

fi

• var/opt/freeware/tmp/rpm-tmp.32064[14]: %posttrans: not found:
  The %posttrans section is missing, we will simply add it even if it is empty, to avoid the log.

Changes

Added this lines as a minifix in the packages/aix/SPECS/wazuh-agent-aix.spec.

• Delete every file (-f) and socket (-s) inside the tree queue/

  find %{_localstatedir}/queue \( -type f -o -type s \) -exec rm -f {} \; || :

• Add %config(missingok) to every file/dir with warnings during uninstallation.
• Modfied some %files in the list to clean uninstallation.
• Commit with al changes:
  wazuh/wazuh@9778f0e

Conclusions

After testing and investigation, I have been able to conclude that most warnings were not necessary and could be resolved without problems.
Only the following have remained:
cannot remove /var/ossec/logs - directory not empty
cannot remove /var/ossec/etc - directory not empty
cannot remove /var/ossec - directory not empty

I have not found a way to prevent them from appearing, as this is expected behavior for the rpmsave files in the configuration.
Although I have tried in the centOS rpm package, and these warnings do not appear:

[root@centos8 vagrant]# rpm -e wazuh-agent
warning: /var/ossec/etc/ossec.conf saved as /var/ossec/etc/ossec.conf.rpmsave

Testing 🟢

bash-4.4# WAZUH_MANAGER="10.0.0.2" rpm -ivh wazuh-agent-4.10.1-3.aix6.1.ppc.rpm
wazuh-agent                 ##################################################

bash-4.4# /var/ossec/bin/wazuh-control start
Starting Wazuh v4.10.1...
Started wazuh-execd...
Started wazuh-agentd...
Started wazuh-syscheckd...
Started wazuh-logcollector...
Started wazuh-modulesd...
Completed.

bash-4.4# rpm -e wazuh-agent
cannot remove /var/ossec/logs - directory not empty
cannot remove /var/ossec/etc - directory not empty
cannot remove /var/ossec - directory not empty

bash-4.4# find /var/ossec -print | sed -e 's;[^/]*/;|____;g;s;____|; |;g'
| |____ossec
| | |____etc
| | | |____ossec.conf.rpmsave
| | |____logs
| | | |____ossec.log.rpmsave

[jotacarma90]

Update 17/10/2024

• Fixed SPECS and investigating errors.
• I am not able to solve the posttrans error at the moment.
• Even if I insert the block, I still get the error. Researching.

Update 18/10/2024

• Testing changes.
• Resolved every warning except one related to directories not empty.
• Edited last comment.

[MarcelKemp]

The messages that appear after the fix are expected, as explained in the following comment:

• Error in AIX agent uninstallation  #607 (comment)