RE: :Cluster::cfs_lock_domain - bizarre issue

[Anthony Galica <anthony.galica@hitachivantara.com>]

I also see this same issue with PVE::Tools::file_set_contents().


-----Original Message-----
From: Anthony Galica <anthony.galica@hitachivantara.com> 
Sent: Friday, July 24, 2026 1:28 AM
To: pve-devel@lists.proxmox.com
Subject: PVE::Cluster::cfs_lock_domain - bizarre issue

Hi everyone,

I am getting a very strange issue from PVE::Cluster::cfs_lock_domain, but only when it is called via activate_volume.  

For each test, I restarted these services first:
systemctl restart pveproxy pvedaemon pvestatd pvescheduler spiceproxy pve-cluster

I have asked Gemini for help, and it continues to suggest various things, but none of them work.

Consider this code:

sub _lock_name {
	my ($context) = @_;

	use constant CONNECTION_LOCK_NAME_HEADER => 'connection-lock-';
	my $serial = $context->serial(); # returns 810050
	return CONNECTION_LOCK_NAME_HEADER . "$serial"; }

my $lock_name = _lock_name($context);
PVE::Cluster::cfs_lock_domain($lock_name, _CONNECTIONS_LOCK_TIMEOUT,  sub { print(""); });

This will *always* fail from within activate_volume (or another subroutine in the same stack) with this error:

	TASK ERROR: cfs-lock 'domain-connection-lock-810050' error: Insecure dependency in mkdir while running with -T switch at /usr/share/perl5/PVE/Cluster.pm line 639.

It also fails if I use sprintf instead.  Or if I append an extra "" (Gemini suggestion), etc.  

When this happens, /etc/pve/priv/lock is empty, and no other calls have been made to activate_volume.

The above code works fine if invoked from a subroutine that was called via the command line.

Now for the really strange part: if I change _lock_name to return the exact same string, only without any formatting, it will work.

Working code:

sub _lock_name {
	my ($context) = @_;

	return 'connection-lock-810050';
}

Does anyone have any insight as to why this is happening and how I can get around it?

Thank you!
Anthony