search for: perform_on_filesystems

In the kernel and qemu communities it is routine for patches that will be backported to stable branches to be posted for review. I'm proposing we do the same for libguestfs stable branches. All of the attached have been tested with 'make check-release'. Rich.

--- sysprep/sysprep_operation.mli | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sysprep/sysprep_operation.mli b/sysprep/sysprep_operation.mli index 61dde72..eb89db4 100644 --- a/sysprep/sysprep_operation.mli +++ b/sysprep/sysprep_operation.mli @@ -16,14 +16,16 @@ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *) -(** Structure used to describe sysprep

...[] + ) + else [] + +let op = { + defaults with + name = "tmp-files"; + enabled_by_default = true; + heading = s_"Remove the tmp files"; + pod_description = Some (s_"\ +This removes the temporary files under C</tmp> and C</var/tmp>."); + perform_on_filesystems = Some tmp_files_perform; +} + +let () = register_operation op -- 1.8.4.27.g0a41de8

This patch series adds a new virt-sysprep operation to offline unenroll a guest from FreeIPA. It does so by removing some configuration files and certificates. Changes from v1: - the other patches were pushed, as unrelated and approved - created a new kerberos-hostkeytab operation Pino Toscano (2): sysprep: add IPA offline unenrollment (RHBZ#1789592) sysprep: add Kerberos keytab file removal

...+ sprintf (f_"\ > +The following files are removed from anywhere in the guest > +filesystem: > + > +%s > + > +On Linux and Unix operating systems, only the following filesystems > +will be examined: > + > +%s") globs_as_pod unix_whitelist_as_pod); > + perform_on_filesystems = Some backup_files_perform; > +} > + > +let () = register_operation op > diff --git a/sysprep/test-virt-sysprep-backup-files.sh b/sysprep/test-virt-sysprep-backup-files.sh > new file mode 100755 > index 0000000..bd9a36c > --- /dev/null > +++ b/sysprep/test-virt-sysprep-back...

...name = "net-hostname"; + enabled_by_default = true; + heading = s_"Remove HOSTNAME in network interface configuration"; + pod_description = Some (s_"\ +For Fedora and Red Hat Enterprise Linux, +this is removed from C<ifcfg-*> files."); + extra_args = []; + perform_on_filesystems = Some net_hostname_perform; + perform_on_devices = None; +} + +let () = register_operation net_hostname_op -- 1.7.12

audit.log is already included in /var/log/audit/*. Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> --- sysprep/sysprep_operation_logfiles.ml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysprep/sysprep_operation_logfiles.ml b/sysprep/sysprep_operation_logfiles.ml index 842b855..cdfe8fc 100644 --- a/sysprep/sysprep_operation_logfiles.ml +++

...name = "pacct-log"; + enabled_by_default = true; + heading = s_"Remove the process accounting log files"; + pod_description = Some (s_"\ +The system wide process accounting will store to the pacct +log files if the process accounting is on."); + extra_args = []; + perform_on_filesystems = Some pacct_log_perform; + perform_on_devices = None; +} + +let () = register_operation pacct_log_op -- 1.7.12.rc1

...= { + defaults with + name = "passwd-backups"; + enabled_by_default = true; + heading = s_"Remove /etc/passwd- and similar backup files"; + pod_description = Some ( + sprintf (f_"\ +On Linux the following files are removed: + +%s") files_as_pod); + perform_on_filesystems = Some passwd_backups_perform; +} + +let () = register_operation op -- 2.10.2

...;> "windows" then ( + (try g#rm "/etc/krb5.keytab" with G.Error _ -> ()) + ) + +let op = { + defaults with + name = "kerberos-hostkeytab"; + enabled_by_default = true; + heading = s_"Remove the Kerberos host keytab file in the guest"; + perform_on_filesystems = Some kerberos_hostkeytab_perform; +} + +let () = register_operation op -- 2.25.4

...op = { + name = "crash-data"; + enabled_by_default = true; + heading = s_"Remove the crash data generated by kexec-tools"; + pod_description = Some (s_"\ +Remove the automatically generated kdump kernel crash data in +C</var/crash/>."); + extra_args = []; + perform_on_filesystems = Some crash_data_perform; + perform_on_devices = None; +} + +let () = register_operation crash_data_op -- 1.8.0

..._by_default = false; + heading = s_"Remove the iptables rules"; + pod_description = Some (s_"\ +The custom iptables rules will be stored in /etc/sysconfig/iptables, +if you do not want to keep these iptables rules, enable this operation +to remove it automatically."); + perform_on_filesystems = Some iptables_perform; +} + +let () = register_operation op -- 1.8.4.27.g0a41de8

...)); + [] + ) + else [] + +let op = { + defaults with + name = "NFS-setting"; + enabled_by_default = false; + heading = s_"Remove the NFS settings"; + pod_description = Some (s_"\ +This removes the NFS settings by removing C</etc/export>."); + perform_on_filesystems = Some nfs_setting_perform; +} + +let () = register_operation op -- 1.8.4.27.g0a41de8

...= false; + heading = s_"Remove the custom tcp wrappers"; + pod_description = Some (s_"\ +This removes the custom tcp wrappers by emptying C</etc/hosts.*>. + +Note this is I<not> enabled by default since it may expose guests +to exploits. Use with care."); + perform_on_filesystems = Some tcp_wrapper_perform; +} + +let () = register_operation op -- 1.8.4.27.g0a41de8

...lse [] + +let op = { + defaults with + name = "kdump-config"; + enabled_by_default = false; + heading = s_"Remove the kdump configurations"; + pod_description = Some (s_"\ +This removes the kdump configurations by emptying C</etc/kdump.conf>."); + perform_on_filesystems = Some kdump_config_perform; +} + +let () = register_operation op -- 1.8.4.27.g0a41de8

...efaults with + name = "firewall-rules"; + enabled_by_default = false; + heading = s_"Remove the firewall rules"; + pod_description = Some (s_"\ +If you do not want to keep the custom firewall rules, enable this operation +to remove it automatically."); + perform_on_filesystems = Some firewall_rules_perform; +} + +let () = register_operation op -- 1.8.4.27.g0a41de8

This patch series adds a new virt-sysprep operation to offline unenroll a guest from FreeIPA. It does so by removing some configuration files and certificates. It requires a change in libguestfs-common before the series is applied. Pino Toscano (4): customize: port do_run to run_in_guest_command sysprep: add a update_system_ca_store side effect sysprep: ca-certificates: request system CA

...= s_"Offline unenroll the guest from FreeIPA"; + pod_description = Some (s_"\ +Unenroll the guest from FreeIPA, reverting and cleaning up the local +server settings only, without interacting with the FreeIPA server. + +This operation does not run C<ipa-client>."); + perform_on_filesystems = Some unenroll_freeipa_perform; +} + +let () = register_operation op -- 2.25.4

...o specify a path to remove."); + extra_args = [ + ("--remove-path", Arg.String add_paths, s_"path" ^ " " ^ s_"Files or directories to be removed on guest"), + s_"\ +Remove the specified path C<file> on guest."; + ]; + + perform_on_filesystems = Some path_perform; +} + +let () = register_operation op -- 1.8.4.474.g128a96c

...heading = s_"Remove the iptables rules"; > + pod_description = Some (s_"\ > +The custom iptables rules will be stored in /etc/sysconfig/iptables, > +if you do not want to keep these iptables rules, enable this operation > +to remove it automatically."); > + perform_on_filesystems = Some iptables_perform; > +} > + > +let () = register_operation op > -- > 1.8.4.27.g0a41de8 Doesn't this delete all the firewall rules (not just removing the custom rules)? Of course the other problem (not with this patch) is that distros using firewalld use a completely diff...