We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Cobblerd start failure due to incorrect ownership of /var/lib/cobbler/web.ss
As has been noted for some time, cobblerd will fail to start after a restart, giving an error about /var/lib/cobbler/web.ss. This was reported in https://github.com/cobbler/cobbler/issues/2183, and discussed elsewhere. When successfully starting, the permission began as: 

`
-rw-r--r--. 1 root root system_u:object_r:cobbler_var_lib_t:s0 1024 Jun  7 09:46 /var/lib/cobbler/web.ss
`

but after starting, the permission becomes:

`
-rw-r--r--. 1 apache root system_u:object_r:cobbler_var_lib_t:s0 1024 Jun  7 09:47 /var/lib/cobbler/web.ss
`

And while the ownership remains as apache, the cobblerd server will fail to start.

<!--- A clear and concise description of what the bug is. -->

The problem is that in cobblerd.py:regen_ss_file(), after this file is created by cobblerd  for  use in authorizing the CLI and web, the routine changes the ownership to 'apache',  and then when the process is restarted, the routine once again tries to open it for writing the random 1024 byte auth token, the open fails. Changing the ownership back to root fixes the issue.

<!--- HINT: You can paste gist.github.com links for long logs or larger files -->

### Steps to reproduce

1. Start the server for the first time... it starts.
2. Restart the server, It will fail with an error opening /var/lib/cobbler/web.ss
3. Changing the ownership of the file back to root.root and restarting will succeed.

### Expected behavior

<!--- A clear and concise description of what you expected to happen. -->
The cobblerd service would restart each and every time.

### Cobbler version

<!--- Paste output from `cobbler version` -->
````
Cobbler 3.3.3
  source: ?, ?
  build time: Tue Jun 14 00:00:00 2022
````
(From EPEL 9 repository)

### Operating system

<!--- On which operating system do you use Cobbler? -->
Rocky Linux release 9.2 (Blue Onyx)

### Cobbler log

<!--- Paste (partial) output from `/var/log/cobbler/cobbler.log` -->
````
[Daemon] 2023-06-07T22:11:08 - INFO | running: ['/usr/sbin/selinuxenabled']
[Daemon] 2023-06-07T22:11:08 - INFO | received on stdout: 
[Daemon] 2023-06-07T22:11:08 - DEBUG | received on stderr: 
[Daemon] 2023-06-07T22:11:08 - INFO | Automigration NOT executed
[Daemon] 2023-06-07T22:11:09 - INFO | python3-hivex not found. If you need Automatic Windows Installation support, please install.
[Daemon] 2023-06-07T22:11:09 - INFO | 11 breeds and 131 OS versions read from the signature file
[Daemon] 2023-06-07T22:11:09 - DEBUG | API handle initialized
[Daemon] 2023-06-07T22:11:09 - ERROR | [Errno 13] Permission denied: '/var/lib/cobbler/web.ss'
````

### Screenshots

<!--- If applicable, add screenshots to help explain your problem. -->

### Additional information

<!--- Add any other context about the problem here. -->
The fix is to remove the call to os.lchown() from cobblerd.py:regen_ss_file()

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `cobbler/cobblerd.py`
Content:
```
1 """
2 Cobbler daemon for logging remote syslog traffic during automatic installation
3 
4 Copyright 2007-2009, Red Hat, Inc and Others
5 Michael DeHaan <michael.dehaan AT gmail>
6 
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11 
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 GNU General Public License for more details.
16 
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
20 02110-1301  USA
21 """
22 
23 import binascii
24 import logging.config
25 import os
26 import pwd
27 import time
28 
29 from cobbler import remote, utils
30 from cobbler.api import CobblerAPI
31 
32 if os.geteuid() == 0 and os.path.exists('/etc/cobbler/logging_config.conf'):
33     logging.config.fileConfig('/etc/cobbler/logging_config.conf')
34 
35 
36 logger = logging.getLogger()
37 
38 
39 def core(cobbler_api: CobblerAPI):
40     """
41     Starts Cobbler.
42 
43     :param cobbler_api: The cobbler_api instance which is used for this method.
44     """
45     settings = cobbler_api.settings()
46     xmlrpc_port = settings.xmlrpc_port
47 
48     regen_ss_file()
49     do_xmlrpc_rw(cobbler_api, xmlrpc_port)
50 
51 
52 def regen_ss_file():
53     """
54     This is only used for Kerberos auth at the moment. It identifies XMLRPC requests from Apache that have already been
55     cleared by Kerberos.
56     """
57     ssfile = "/var/lib/cobbler/web.ss"
58     with open("/dev/urandom", 'rb') as fd:
59         data = fd.read(512)
60 
61     with open(ssfile, 'wb', 0o660) as fd:
62         fd.write(binascii.hexlify(data))
63 
64     http_user = "apache"
65     family = utils.get_family()
66     if family == "debian":
67         http_user = "www-data"
68     elif family == "suse":
69         http_user = "wwwrun"
70     os.lchown("/var/lib/cobbler/web.ss", pwd.getpwnam(http_user)[2], -1)
71 
72 
73 def do_xmlrpc_rw(cobbler_api: CobblerAPI, port):
74     """
75     This trys to bring up the Cobbler xmlrpc_api and restart it if it fails.
76 
77     :param cobbler_api: The cobbler_api instance which is used for this method.
78     :param port: The port where the xmlrpc api should run on.
79     """
80     xinterface = remote.ProxiedXMLRPCInterface(cobbler_api, remote.CobblerXMLRPCInterface)
81     server = remote.CobblerXMLRPCServer(('127.0.0.1', port))
82     server.logRequests = 0      # don't print stuff
83     logger.debug("XMLRPC running on %s", port)
84     server.register_instance(xinterface)
85     start_time = ""
86     try:
87         import psutil
88         p = psutil.Process(os.getpid())
89         start_time = " in %s seconds" % str(time.time() - p.create_time())
90     except ModuleNotFoundError:
91         # This is not critical, but debug only - just install python3-psutil
92         pass
93 
94     while True:
95         try:
96             logger.info("Cobbler startup completed %s", start_time)
97             server.serve_forever()
98         except IOError:
99             # interrupted? try to serve again
100             time.sleep(0.5)
101 
102 
103 if __name__ == "__main__":
104     core(CobblerAPI())
105
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/cobbler/cobblerd.py b/cobbler/cobblerd.py
--- a/cobbler/cobblerd.py
+++ b/cobbler/cobblerd.py
@@ -23,10 +23,9 @@
 import binascii
 import logging.config
 import os
-import pwd
 import time
 
-from cobbler import remote, utils
+from cobbler import remote
 from cobbler.api import CobblerAPI
 
 if os.geteuid() == 0 and os.path.exists('/etc/cobbler/logging_config.conf'):
@@ -61,14 +60,6 @@
     with open(ssfile, 'wb', 0o660) as fd:
         fd.write(binascii.hexlify(data))
 
-    http_user = "apache"
-    family = utils.get_family()
-    if family == "debian":
-        http_user = "www-data"
-    elif family == "suse":
-        http_user = "wwwrun"
-    os.lchown("/var/lib/cobbler/web.ss", pwd.getpwnam(http_user)[2], -1)
-
 
 def do_xmlrpc_rw(cobbler_api: CobblerAPI, port):
     """

{"golden_diff": "diff --git a/cobbler/cobblerd.py b/cobbler/cobblerd.py\n--- a/cobbler/cobblerd.py\n+++ b/cobbler/cobblerd.py\n@@ -23,10 +23,9 @@\n import binascii\n import logging.config\n import os\n-import pwd\n import time\n \n-from cobbler import remote, utils\n+from cobbler import remote\n from cobbler.api import CobblerAPI\n \n if os.geteuid() == 0 and os.path.exists('/etc/cobbler/logging_config.conf'):\n@@ -61,14 +60,6 @@\n     with open(ssfile, 'wb', 0o660) as fd:\n         fd.write(binascii.hexlify(data))\n \n-    http_user = \"apache\"\n-    family = utils.get_family()\n-    if family == \"debian\":\n-        http_user = \"www-data\"\n-    elif family == \"suse\":\n-        http_user = \"wwwrun\"\n-    os.lchown(\"/var/lib/cobbler/web.ss\", pwd.getpwnam(http_user)[2], -1)\n-\n \n def do_xmlrpc_rw(cobbler_api: CobblerAPI, port):\n     \"\"\"\n", "issue": "Cobblerd start failure due to incorrect ownership of /var/lib/cobbler/web.ss\nAs has been noted for some time, cobblerd will fail to start after a restart, giving an error about /var/lib/cobbler/web.ss. This was reported in https://github.com/cobbler/cobbler/issues/2183, and discussed elsewhere. When successfully starting, the permission began as: \r\n\r\n`\r\n-rw-r--r--. 1 root root system_u:object_r:cobbler_var_lib_t:s0 1024 Jun  7 09:46 /var/lib/cobbler/web.ss\r\n`\r\n\r\nbut after starting, the permission becomes:\r\n\r\n`\r\n-rw-r--r--. 1 apache root system_u:object_r:cobbler_var_lib_t:s0 1024 Jun  7 09:47 /var/lib/cobbler/web.ss\r\n`\r\n\r\nAnd while the ownership remains as apache, the cobblerd server will fail to start.\r\n\r\n<!--- A clear and concise description of what the bug is. -->\r\n\r\nThe problem is that in cobblerd.py:regen_ss_file(), after this file is created by cobblerd  for  use in authorizing the CLI and web, the routine changes the ownership to 'apache',  and then when the process is restarted, the routine once again tries to open it for writing the random 1024 byte auth token, the open fails. Changing the ownership back to root fixes the issue.\r\n\r\n<!--- HINT: You can paste gist.github.com links for long logs or larger files -->\r\n\r\n### Steps to reproduce\r\n\r\n1. Start the server for the first time... it starts.\r\n2. Restart the server, It will fail with an error opening /var/lib/cobbler/web.ss\r\n3. Changing the ownership of the file back to root.root and restarting will succeed.\r\n\r\n### Expected behavior\r\n\r\n<!--- A clear and concise description of what you expected to happen. -->\r\nThe cobblerd service would restart each and every time.\r\n\r\n### Cobbler version\r\n\r\n<!--- Paste output from `cobbler version` -->\r\n````\r\nCobbler 3.3.3\r\n  source: ?, ?\r\n  build time: Tue Jun 14 00:00:00 2022\r\n````\r\n(From EPEL 9 repository)\r\n\r\n### Operating system\r\n\r\n<!--- On which operating system do you use Cobbler? -->\r\nRocky Linux release 9.2 (Blue Onyx)\r\n\r\n### Cobbler log\r\n\r\n<!--- Paste (partial) output from `/var/log/cobbler/cobbler.log` -->\r\n````\r\n[Daemon] 2023-06-07T22:11:08 - INFO | running: ['/usr/sbin/selinuxenabled']\r\n[Daemon] 2023-06-07T22:11:08 - INFO | received on stdout: \r\n[Daemon] 2023-06-07T22:11:08 - DEBUG | received on stderr: \r\n[Daemon] 2023-06-07T22:11:08 - INFO | Automigration NOT executed\r\n[Daemon] 2023-06-07T22:11:09 - INFO | python3-hivex not found. If you need Automatic Windows Installation support, please install.\r\n[Daemon] 2023-06-07T22:11:09 - INFO | 11 breeds and 131 OS versions read from the signature file\r\n[Daemon] 2023-06-07T22:11:09 - DEBUG | API handle initialized\r\n[Daemon] 2023-06-07T22:11:09 - ERROR | [Errno 13] Permission denied: '/var/lib/cobbler/web.ss'\r\n````\r\n\r\n### Screenshots\r\n\r\n<!--- If applicable, add screenshots to help explain your problem. -->\r\n\r\n### Additional information\r\n\r\n<!--- Add any other context about the problem here. -->\r\nThe fix is to remove the call to os.lchown() from cobblerd.py:regen_ss_file()\n", "before_files": [{"content": "\"\"\"\nCobbler daemon for logging remote syslog traffic during automatic installation\n\nCopyright 2007-2009, Red Hat, Inc and Others\nMichael DeHaan <michael.dehaan AT gmail>\n\nThis program is free software; you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 2 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program; if not, write to the Free Software\nFoundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA\n02110-1301  USA\n\"\"\"\n\nimport binascii\nimport logging.config\nimport os\nimport pwd\nimport time\n\nfrom cobbler import remote, utils\nfrom cobbler.api import CobblerAPI\n\nif os.geteuid() == 0 and os.path.exists('/etc/cobbler/logging_config.conf'):\n    logging.config.fileConfig('/etc/cobbler/logging_config.conf')\n\n\nlogger = logging.getLogger()\n\n\ndef core(cobbler_api: CobblerAPI):\n    \"\"\"\n    Starts Cobbler.\n\n    :param cobbler_api: The cobbler_api instance which is used for this method.\n    \"\"\"\n    settings = cobbler_api.settings()\n    xmlrpc_port = settings.xmlrpc_port\n\n    regen_ss_file()\n    do_xmlrpc_rw(cobbler_api, xmlrpc_port)\n\n\ndef regen_ss_file():\n    \"\"\"\n    This is only used for Kerberos auth at the moment. It identifies XMLRPC requests from Apache that have already been\n    cleared by Kerberos.\n    \"\"\"\n    ssfile = \"/var/lib/cobbler/web.ss\"\n    with open(\"/dev/urandom\", 'rb') as fd:\n        data = fd.read(512)\n\n    with open(ssfile, 'wb', 0o660) as fd:\n        fd.write(binascii.hexlify(data))\n\n    http_user = \"apache\"\n    family = utils.get_family()\n    if family == \"debian\":\n        http_user = \"www-data\"\n    elif family == \"suse\":\n        http_user = \"wwwrun\"\n    os.lchown(\"/var/lib/cobbler/web.ss\", pwd.getpwnam(http_user)[2], -1)\n\n\ndef do_xmlrpc_rw(cobbler_api: CobblerAPI, port):\n    \"\"\"\n    This trys to bring up the Cobbler xmlrpc_api and restart it if it fails.\n\n    :param cobbler_api: The cobbler_api instance which is used for this method.\n    :param port: The port where the xmlrpc api should run on.\n    \"\"\"\n    xinterface = remote.ProxiedXMLRPCInterface(cobbler_api, remote.CobblerXMLRPCInterface)\n    server = remote.CobblerXMLRPCServer(('127.0.0.1', port))\n    server.logRequests = 0      # don't print stuff\n    logger.debug(\"XMLRPC running on %s\", port)\n    server.register_instance(xinterface)\n    start_time = \"\"\n    try:\n        import psutil\n        p = psutil.Process(os.getpid())\n        start_time = \" in %s seconds\" % str(time.time() - p.create_time())\n    except ModuleNotFoundError:\n        # This is not critical, but debug only - just install python3-psutil\n        pass\n\n    while True:\n        try:\n            logger.info(\"Cobbler startup completed %s\", start_time)\n            server.serve_forever()\n        except IOError:\n            # interrupted? try to serve again\n            time.sleep(0.5)\n\n\nif __name__ == \"__main__\":\n    core(CobblerAPI())\n", "path": "cobbler/cobblerd.py"}], "after_files": [{"content": "\"\"\"\nCobbler daemon for logging remote syslog traffic during automatic installation\n\nCopyright 2007-2009, Red Hat, Inc and Others\nMichael DeHaan <michael.dehaan AT gmail>\n\nThis program is free software; you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 2 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program; if not, write to the Free Software\nFoundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA\n02110-1301  USA\n\"\"\"\n\nimport binascii\nimport logging.config\nimport os\nimport time\n\nfrom cobbler import remote\nfrom cobbler.api import CobblerAPI\n\nif os.geteuid() == 0 and os.path.exists('/etc/cobbler/logging_config.conf'):\n    logging.config.fileConfig('/etc/cobbler/logging_config.conf')\n\n\nlogger = logging.getLogger()\n\n\ndef core(cobbler_api: CobblerAPI):\n    \"\"\"\n    Starts Cobbler.\n\n    :param cobbler_api: The cobbler_api instance which is used for this method.\n    \"\"\"\n    settings = cobbler_api.settings()\n    xmlrpc_port = settings.xmlrpc_port\n\n    regen_ss_file()\n    do_xmlrpc_rw(cobbler_api, xmlrpc_port)\n\n\ndef regen_ss_file():\n    \"\"\"\n    This is only used for Kerberos auth at the moment. It identifies XMLRPC requests from Apache that have already been\n    cleared by Kerberos.\n    \"\"\"\n    ssfile = \"/var/lib/cobbler/web.ss\"\n    with open(\"/dev/urandom\", 'rb') as fd:\n        data = fd.read(512)\n\n    with open(ssfile, 'wb', 0o660) as fd:\n        fd.write(binascii.hexlify(data))\n\n\ndef do_xmlrpc_rw(cobbler_api: CobblerAPI, port):\n    \"\"\"\n    This trys to bring up the Cobbler xmlrpc_api and restart it if it fails.\n\n    :param cobbler_api: The cobbler_api instance which is used for this method.\n    :param port: The port where the xmlrpc api should run on.\n    \"\"\"\n    xinterface = remote.ProxiedXMLRPCInterface(cobbler_api, remote.CobblerXMLRPCInterface)\n    server = remote.CobblerXMLRPCServer(('127.0.0.1', port))\n    server.logRequests = 0      # don't print stuff\n    logger.debug(\"XMLRPC running on %s\", port)\n    server.register_instance(xinterface)\n    start_time = \"\"\n    try:\n        import psutil\n        p = psutil.Process(os.getpid())\n        start_time = \" in %s seconds\" % str(time.time() - p.create_time())\n    except ModuleNotFoundError:\n        # This is not critical, but debug only - just install python3-psutil\n        pass\n\n    while True:\n        try:\n            logger.info(\"Cobbler startup completed %s\", start_time)\n            server.serve_forever()\n        except IOError:\n            # interrupted? try to serve again\n            time.sleep(0.5)\n\n\nif __name__ == \"__main__\":\n    core(CobblerAPI())\n", "path": "cobbler/cobblerd.py"}]}