search for: debug_augeas_errors

Continuation/rework of: https://www.redhat.com/archives/libguestfs/2020-May/msg00020.html This is my approach, as I explained here: https://bugzilla.redhat.com/show_bug.cgi?id=1828952#c4 https://www.redhat.com/archives/libguestfs/2020-May/msg00035.html IOW: do not attempt to relabel if the guest is not enforcing, as it is either useless or may fail; few words more are in the comments of patch #3.

...ertions(+), 21 deletions(-) diff --git a/v2v/linux.ml b/v2v/linux.ml index 43449157b..99b0e0e7b 100644 --- a/v2v/linux.ml +++ b/v2v/linux.ml @@ -27,6 +27,8 @@ open Utils module G = Guestfs +let re_version = PCRE.compile "(\\d+)\\.(\\d+)" + let augeas_reload g = g#aug_load (); debug_augeas_errors g @@ -80,29 +82,44 @@ let file_list_of_package (g : Guestfs.guestfs) inspect app = | "rpm" -> (* Since RPM allows multiple packages installed with the same - * name, always check the full ENVR here (RHBZ#1161250). + * name, always check the full NEVR here (RHBZ#116125...

...++++++++++++++ > v2v/linux.mli | 3 +++ > 2 files changed, 22 insertions(+) > > diff --git a/v2v/linux.ml b/v2v/linux.ml > index 177724e39..6a5cae512 100644 > --- a/v2v/linux.ml > +++ b/v2v/linux.ml > @@ -31,6 +31,25 @@ let augeas_reload g = > g#aug_load (); > debug_augeas_errors g > > +let rec install g inspect packages = > + if packages <> [] then ( > + do_install g inspect packages; > + (* Reload Augeas in case anything changed. *) > + augeas_reload g > + ) > + > +and do_install g { i_package_format = package_format } package...

...ertions(+), 21 deletions(-) diff --git a/v2v/linux.ml b/v2v/linux.ml index 43449157b..63489c334 100644 --- a/v2v/linux.ml +++ b/v2v/linux.ml @@ -27,6 +27,8 @@ open Utils module G = Guestfs +let re_version = PCRE.compile "(\\d+)\\.(\\d+)" + let augeas_reload g = g#aug_load (); debug_augeas_errors g @@ -80,29 +82,40 @@ let file_list_of_package (g : Guestfs.guestfs) inspect app = | "rpm" -> (* Since RPM allows multiple packages installed with the same - * name, always check the full ENVR here (RHBZ#1161250). + * name, always check the full NEVR here (RHBZ#116125...

..." (16+32) (* AUG_SAVE_NOOP | AUG_NO_LOAD *); - (* See: https://bugzilla.redhat.com/show_bug.cgi?id=975412#c0 *) - ignore (g#aug_rm "/augeas/load/*[\"/etc/selinux/config/\" !~ regexp('^') + glob(incl) + regexp('/.*')]"); - g#aug_load (); - debug_augeas_errors g; - - (* Get the SELinux policy name, eg. "targeted", "minimum". - * Use "targeted" if not specified, just like libselinux does. +let rec relabel (g : G.guestfs) = + (* Is the guest using SELinux? (Otherwise this is a no-op). *) + if is_selinux_guest g t...

...\ $(settings_test_scripts) check-slow: diff --git a/customize/SELinux_relabel.ml b/customize/SELinux_relabel.ml index d404c35fa..e7d440c29 100644 --- a/customize/SELinux_relabel.ml +++ b/customize/SELinux_relabel.ml @@ -37,8 +37,18 @@ let relabel (g : G.guestfs) = g#aug_load (); debug_augeas_errors g; - (* Get the SELinux policy name, eg. "targeted", "minimum". *) - let policy = g#aug_get "/files/etc/selinux/config/SELINUXTYPE" in + (* Get the SELinux policy name, eg. "targeted", "minimum". + * Use "targeted" i...

...x_not_enforcing -> > + (* This means that SELinux was not configured to be in enforcing mode, > + * so silently accept this. > + *) > + () > ) > > and is_selinux_guest g = > @@ -59,6 +68,21 @@ and use_setfiles g = > g#aug_load (); > debug_augeas_errors g; > > + (* Get the SELinux enforcing mode, eg "enforcing", "permissive", > + * "disabled". > + * Use "disabled" if not specified, just like libselinux seems to do. > + *) > + let typ = read_selinux_config_key g "SELINUX"...

...lembi@redhat.com> --- v2v/linux.ml | 19 +++++++++++++++++++ v2v/linux.mli | 3 +++ 2 files changed, 22 insertions(+) diff --git a/v2v/linux.ml b/v2v/linux.ml index 177724e39..6a5cae512 100644 --- a/v2v/linux.ml +++ b/v2v/linux.ml @@ -31,6 +31,25 @@ let augeas_reload g = g#aug_load (); debug_augeas_errors g +let rec install g inspect packages = + if packages <> [] then ( + do_install g inspect packages; + (* Reload Augeas in case anything changed. *) + augeas_reload g + ) + +and do_install g { i_package_format = package_format } packages = + assert (List.length packages > 0);...

...t;tgolembi@redhat.com> --- v2v/linux.ml | 14 ++++++++++++++ v2v/linux.mli | 3 +++ 2 files changed, 17 insertions(+) diff --git a/v2v/linux.ml b/v2v/linux.ml index 177724e39..966170cdd 100644 --- a/v2v/linux.ml +++ b/v2v/linux.ml @@ -31,6 +31,20 @@ let augeas_reload g = g#aug_load (); debug_augeas_errors g +let rec install_local g { i_package_format = package_format } packages = + if packages <> [] then ( + match package_format with + | "rpm" -> + let cmd = [ "rpm"; "--upgrade"; "-v" ] @ packages in + let cmd = Array.of_list cmd in...

...t;tgolembi@redhat.com> --- v2v/linux.ml | 14 ++++++++++++++ v2v/linux.mli | 3 +++ 2 files changed, 17 insertions(+) diff --git a/v2v/linux.ml b/v2v/linux.ml index 177724e39..966170cdd 100644 --- a/v2v/linux.ml +++ b/v2v/linux.ml @@ -31,6 +31,20 @@ let augeas_reload g = g#aug_load (); debug_augeas_errors g +let rec install_local g { i_package_format = package_format } packages = + if packages <> [] then ( + match package_format with + | "rpm" -> + let cmd = [ "rpm"; "--upgrade"; "-v" ] @ packages in + let cmd = Array.of_list cmd in...

...g#touch "/.autorelabel" + | SELinux_not_enforcing -> + (* This means that SELinux was not configured to be in enforcing mode, + * so silently accept this. + *) + () ) and is_selinux_guest g = @@ -59,6 +68,21 @@ and use_setfiles g = g#aug_load (); debug_augeas_errors g; + (* Get the SELinux enforcing mode, eg "enforcing", "permissive", + * "disabled". + * Use "disabled" if not specified, just like libselinux seems to do. + *) + let typ = read_selinux_config_key g "SELINUX" "disabled" in + (*...

...gt; > 2 files changed, 22 insertions(+) > > > > diff --git a/v2v/linux.ml b/v2v/linux.ml > > index 177724e39..6a5cae512 100644 > > --- a/v2v/linux.ml > > +++ b/v2v/linux.ml > > @@ -31,6 +31,25 @@ let augeas_reload g = > > g#aug_load (); > > debug_augeas_errors g > > > > +let rec install g inspect packages = > > + if packages <> [] then ( > > + do_install g inspect packages; > > + (* Reload Augeas in case anything changed. *) > > + augeas_reload g > > + ) > > + > > +and do_install g...

We can use the setfiles(8) command to relabel the guest filesystem, even though we don't have a policy loaded nor SELinux enabled in the appliance kernel. This also deprecates or removes the old and broken SELinux support. This patch isn't quite complete - I would like to add some tests to the new API. I'm posting here to garner early feedback. Rich.

...ns that SELinux was not configured to be in enforcing mode, > > + * so silently accept this. > > + *) > > + () > > ) > > > > and is_selinux_guest g = > > @@ -59,6 +68,21 @@ and use_setfiles g = > > g#aug_load (); > > debug_augeas_errors g; > > > > + (* Get the SELinux enforcing mode, eg "enforcing", "permissive", > > + * "disabled". > > + * Use "disabled" if not specified, just like libselinux seems to do. > > + *) > > + let typ = read_selinux_co...

v1 -> v2: - Add simple test of the setfiles API. - Use SELinux_relabel module in virt-v2v (instead of touch /.autorelabel). - Small fixes. Rich.

This installs packages with QEMU Guest Agent when converting Linux machine. The packages should be available on guest tools ISO. The patches work "as-is" but probably deserve some more attention: - it is "abusing" Winows_virtio code but renaming/refactoring everything to remove "windows" from the name and use "guest tools" seems like a lot of unnecesary

...aug_init "/" (16+32) (* AUG_SAVE_NOOP | AUG_NO_LOAD *); + (* See: https://bugzilla.redhat.com/show_bug.cgi?id=975412#c0 *) + ignore (g#aug_rm "/augeas/load/*[\"/etc/selinux/config/\" !~ regexp('^') + glob(incl) + regexp('/.*')]"); + g#aug_load (); + debug_augeas_errors g; + + (* Get the SELinux policy name, eg. "targeted", "minimum". *) + let policy = g#aug_get "/files/etc/selinux/config/SELINUXTYPE" in + g#aug_close (); + + (* Get the spec file name. *) + let specfile = + sprintf "/etc/selinux/%s/contexts/files/file_con...

changes in v2: - moved copy_drivers above copy_files - renamed copy_files to copy_from_virtio_win - renamed install to install_local - use rpm instead of yum This installs packages with QEMU Guest Agent when converting Linux machine. The packages should be available on guest tools ISO. The patches work "as-is" but probably deserve some more attention: - it is "abusing"

changes in v3: - fix call to install_local changes in v2: - moved copy_drivers above copy_files - renamed copy_files to copy_from_virtio_win - renamed install to install_local - use rpm instead of yum This installs packages with QEMU Guest Agent when converting Linux machine. The packages should be available on guest tools ISO. The patches work "as-is" but probably deserve some more

changes in v4: - fix call to install_local changes in v2: - moved copy_drivers above copy_files - renamed copy_files to copy_from_virtio_win - renamed install to install_local - use rpm instead of yum This installs packages with QEMU Guest Agent when converting Linux machine. The packages should be available on guest tools ISO. The patches work "as-is" but probably deserve some more