search for: aug_ls

[This email is either empty or too large to be displayed at this time]

...v -x --selinux-relabel -a ta.qcow2 -a ta1.qcow2 > virt-customize --selinux-relabel -a throwaway.qcow2 > rm throwaway.qcow2 Here is a most interesting snippet from `virt-customize -v -x --selinux-relabel -a ta.qcow2 -a ta1.qcow2' output: ... many lines skipped ... libguestfs: trace: aug_ls "/files/etc/selinux/config" guestfsd: <= aug_ls (0x1c) request length 72 bytes libguestfs: trace: aug_ls = ["/files/etc/selinux/config/#comment[1]", "/files/etc/selinux/config/#comment[2]", "/files/etc/selinux/config/#comment[3]", "/files/etc/selinux/...

...x? *) if g#is_file ~followsymlinks:true "/usr/sbin/load_policy" && @@ -44,7 +48,7 @@ let relabel (g : G.guestfs) = let config_path = "/files/etc/selinux/config" in let selinuxtype_path = config_path ^ "/SELINUXTYPE" in let keys = g#aug_ls config_path in - if Array.mem selinuxtype_path keys then + if array_find selinuxtype_path keys then g#aug_get selinuxtype_path else "targeted" in -- 2.14.3

Continuation/rework of: https://www.redhat.com/archives/libguestfs/2020-May/msg00020.html This is my approach, as I explained here: https://bugzilla.redhat.com/show_bug.cgi?id=1828952#c4 https://www.redhat.com/archives/libguestfs/2020-May/msg00035.html IOW: do not attempt to relabel if the guest is not enforcing, as it is either useless or may fail; few words more are in the comments of patch #3.

Having SELinux enabled (even if not enforcing) in the appliance causes troubles to applications/libraries that read/write SELinux attributes. --- builder/builder.ml | 6 +++++- customize/customize_main.ml | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/builder/builder.ml b/builder/builder.ml index a407924..5195cfd 100644 --- a/builder/builder.ml +++

...t includes the case where a non-SELinux + * host is processing an SELinux guest, and other things. *) - let policy = - let config_path = "/files/etc/selinux/config" in - let selinuxtype_path = config_path ^ "/SELINUXTYPE" in - let keys = g#aug_ls config_path in - if array_find selinuxtype_path keys then - g#aug_get selinuxtype_path - else - "targeted" in + g#touch "/.autorelabel" + ) - g#aug_close (); +and is_selinux_guest g = + g#is_file ~followsymlinks:true "/usr/sbin/...

...t;, "minimum". + * Use "targeted" if not specified, just like libselinux does. + *) + let policy = + let config_path = "/files/etc/selinux/config" in + let selinuxtype_path = config_path ^ "/SELINUXTYPE" in + let keys = g#aug_ls config_path in + if Array.mem selinuxtype_path keys then + g#aug_get selinuxtype_path + else + "targeted" in + g#aug_close (); (* Get the spec file name. *) diff --git a/customize/test-selinuxrelabel.sh b/customize/test-selinuxrelabel.sh new...

...r problem. If we still can't do a hard > requirement for Augeas, let's use workaround proposed by Pino: > let () = > (* Apply the "grub" lens if it is not handling the file > * already -- Augeas < 1.7.0 will error out otherwise. > *) > if g#aug_ls ("/files" ^ grub_config) = [||] then > g#aug_transform "grub" grub_config in > > As a temporary solution looks fine. Better this solution than raising the Augeas requirements, for now. -- Pino Toscano

...gt;requirement for Augeas, let's use workaround proposed by Pino: > >> let () = > >> (* Apply the "grub" lens if it is not handling the file > >> * already -- Augeas < 1.7.0 will error out otherwise. > >> *) > >> if g#aug_ls ("/files" ^ grub_config) = [||] then > >> g#aug_transform "grub" grub_config in > >> > >>As a temporary solution looks fine. > > > >Better this solution than raising the Augeas requirements, for now. > > > > Rich, What ab...

...ributes of + * /etc/shadow, so we can restore them later. + *) + let tempfile = g#mktemp "/etc/shadow.guestfsXXXXXX" in + g#write tempfile "*"; + g#copy_attributes ~all:true "/etc/shadow" tempfile; + g#aug_init "/" 0; let users = Array.to_list (g#aug_ls "/files/etc/shadow") in List.iter ( @@ -116,9 +123,11 @@ let rec set_linux_passwords ~prog ?password_crypto g root passwords = with Not_found -> () ) users; g#aug_save (); + g#aug_close (); - (* In virt-sysprep /.autorelabel will label it correctly. *) - g#chmod 0...

...ns(+), 16 deletions(-) diff --git a/customize/password.ml b/customize/password.ml index 25ce901..cb97804 100644 --- a/customize/password.ml +++ b/customize/password.ml @@ -97,9 +97,7 @@ let rec set_linux_passwords ?password_crypto (g : Guestfs.guestfs) root password let users = Array.to_list (g#aug_ls "/files/etc/shadow") in List.iter ( fun userpath -> - let user = - let i = String.rindex userpath '/' in - String.sub userpath (i+1) (String.length userpath -i-1) in + let user = last_part_of userpath '/' in try (* Each li...

...esentation. *) > class bootloader_grub1 (g : G.guestfs) inspect grub_config = > + let () = Wrong indentation here. > + (* Apply the "grub" lens if it is not handling the file > + * already -- Augeas < 1.7.0 will error out otherwise. > + *) > + if g#aug_ls ("/files" ^ grub_config) = [||] then > + g#aug_transform "grub" grub_config in > + > (* Grub prefix? Usually "/boot". *) > let grub_prefix = > let mounts = g#inspect_get_mountpoints inspect.i_root in > @@ -191,7 +202,7 @@ type default...

...@@ let remove_hd_prefix path = (* Grub1 (AKA grub-legacy) representation. *) class bootloader_grub1 (g : G.guestfs) inspect grub_config = + let () = + (* Apply the "grub" lens if it is not handling the file + * already -- Augeas < 1.7.0 will error out otherwise. + *) + if g#aug_ls ("/files" ^ grub_config) = [||] then + g#aug_transform "grub" grub_config in + (* Grub prefix? Usually "/boot". *) let grub_prefix = let mounts = g#inspect_get_mountpoints inspect.i_root in @@ -335,33 +342,46 @@ object (self) end let detect_bootloade...

...grub_config = > >>+ let () = > > > >Wrong indentation here. > > > >>+ (* Apply the "grub" lens if it is not handling the file > >>+ * already -- Augeas < 1.7.0 will error out otherwise. > >>+ *) > >>+ if g#aug_ls ("/files" ^ grub_config) = [||] then > >>+ g#aug_transform "grub" grub_config in > >>+ > >> (* Grub prefix? Usually "/boot". *) > >> let grub_prefix = > >> let mounts = g#inspect_get_mountpoints inspect.i_ro...

This way it is possible to use rm_rf_only_files, but not removing specific files. --- mllib/common_utils.ml | 8 +++++++- mllib/common_utils.mli | 5 ++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/mllib/common_utils.ml b/mllib/common_utils.ml index 516cff3..3737b4c 100644 --- a/mllib/common_utils.ml +++ b/mllib/common_utils.ml @@ -640,13 +640,19 @@ let rmdir_on_exit = *

This reimplements the augeas APIs using ocaml-augeas (dropping all the C code). The behaviour seems unchanged, although I may have not tested all the various corner cases. Changes from v2: - dropped patch #1, as it was applied already (was a real bugfix) - rebased on master Pino Toscano (3): Revert "Revert "daemon: implement OptString for OCaml APIs"" daemon: move augeas

This reimplements the augeas APIs using ocaml-augeas (dropping all the C code). The behaviour seems unchanged, although I may have not tested all the various corner cases. Pino Toscano (4): daemon: fix/enhance error reporting of Augeas exceptions Revert "Revert "daemon: implement OptString for OCaml APIs"" daemon: move augeas APIs to OCaml daemon: drop usage of C

This synchronizes the embedded ocaml-augeas copy, and reimplements the augeas APIs using it (dropping all the C code). The behaviour seems unchanged, although I may have not tested all the various corner cases. Pino Toscano (5): common/mlaugeas: Synchronize with latest ocaml-augeas daemon: fix/enhance error reporting of Augeas exceptions Revert "Revert "daemon: implement

Hi, currently /etc/shadow is edited manually when needed (i.e. when setting the password for an user), and it is not changed when removing users. Import the upstream shadow.aug (currently in their development serie, but not part of any released version yet), and use it only when the augeas version is less than a potential 1.2.1 (covering also the case when the new version is just 1.3.0). Pino

Augeas 1.7.0 was released a couple of days ago. By encouraging everyone to upgrade to this we can drop several calls to aug_transform and also our custom copies of two lenses, and a lot of related code. Rich.