ipa/SOURCES/0009-ipa-client-install-use-the-authselect-backup-during_rhbz#1810179.patch

From ca880cfb117fc870a6e2710b9e31b2f67d5651e1 Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Wed, 29 Jul 2020 13:35:49 +0200
Subject: [PATCH] ipa-client-install: use the authselect backup during
 uninstall

When ipa-client-install is run on a system with no existing
authselect configuration (for instance a fedora 31 new install),
uninstallation is picking sssd profile but this may lead to
a configuration with differences compared to the pre-ipa-client
state.

Now that authselect provides an option to backup the existing
configuration prior to setting a profile, the client install
can save the backup name and uninstall is able to apply the
backup in order to go back to the pre-ipa-client state.

Fixes: https://pagure.io/freeipa/issue/8189
Reviewed-By: Francois Cami <fcami@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
---
 ipaplatform/redhat/authconfig.py | 37 ++++++++++++++------------------
 1 file changed, 16 insertions(+), 21 deletions(-)

diff --git a/ipaplatform/redhat/authconfig.py b/ipaplatform/redhat/authconfig.py
index 758376f2b..89f452d66 100644
--- a/ipaplatform/redhat/authconfig.py
+++ b/ipaplatform/redhat/authconfig.py
@@ -27,6 +27,7 @@ from ipaplatform.paths import paths
 from ipapython import ipautil
 from ipapython.admintool import ScriptError
 import os
+import time
 
 FILES_TO_NOT_BACKUP = ['passwd', 'group', 'shadow', 'gshadow']
 
@@ -103,28 +104,16 @@ class RedHatAuthSelect(RedHatAuthToolBase):
     def configure(self, sssd, mkhomedir, statestore, sudo=True):
         # In the statestore, the following keys are used for the
         # 'authselect' module:
+        # Old method:
         # profile: name of the profile configured pre-installation
         # features_list: list of features configured pre-installation
         # mkhomedir: True if installation was called with --mkhomedir
         # profile and features_list are used when reverting to the
         # pre-install state
-        cfg = self._parse_authselect_output()
-        if cfg:
-            statestore.backup_state('authselect', 'profile', cfg[0])
-            statestore.backup_state(
-                    'authselect', 'features_list', " ".join(cfg[1]))
-        else:
-            # cfg = None means that the current conf is not managed by
-            # authselect but by authconfig.
-            # As we are using authselect to configure the host,
-            # it will not be possible to revert to a custom authconfig
-            # configuration later (during uninstall)
-            # Best thing to do will be to use sssd profile at this time
-            logger.warning(
-                "WARNING: The configuration pre-client installation is not "
-                "managed by authselect and cannot be backed up. "
-                "Uninstallation may not be able to revert to the original "
-                "state.")
+        # New method:
+        # backup: name of the authselect backup
+        backup_name = "pre_ipaclient_{}".format(time.strftime("%Y%m%d%H%M%S"))
+        statestore.backup_state('authselect', 'backup', backup_name)
 
         cmd = [paths.AUTHSELECT, "select", "sssd"]
         if mkhomedir:
@@ -133,6 +122,7 @@ class RedHatAuthSelect(RedHatAuthToolBase):
         if sudo:
             cmd.append("with-sudo")
         cmd.append("--force")
+        cmd.append("--backup={}".format(backup_name))
 
         ipautil.run(cmd)
 
@@ -179,10 +169,15 @@ class RedHatAuthSelect(RedHatAuthToolBase):
             else:
                 features = []
 
-        cmd = [paths.AUTHSELECT, "select", profile]
-        cmd.extend(features)
-        cmd.append("--force")
-        ipautil.run(cmd)
+        backup = statestore.restore_state('authselect', 'backup')
+        if backup:
+            cmd = [paths.AUTHSELECT, "backup-restore", backup]
+            ipautil.run(cmd)
+        else:
+            cmd = [paths.AUTHSELECT, "select", profile]
+            cmd.extend(features)
+            cmd.append("--force")
+            ipautil.run(cmd)
 
     def backup(self, path):
         current = self._get_authselect_current_output()
-- 
2.26.2

# Not needed for 4.7.8 release
#
#From 3eaab97e317584bc47d4a27a607267ed90df7ff7 Mon Sep 17 00:00:00 2001
#From: Florence Blanc-Renaud <flo@redhat.com>
#Date: Wed, 29 Jul 2020 13:40:26 +0200
#Subject: [PATCH] ipatests: remove the xfail for test_nfs.py
#
#Related: https://pagure.io/freeipa/issue/8189
#Reviewed-By: Francois Cami <fcami@redhat.com>
#Reviewed-By: Michal Polovka <mpolovka@redhat.com>
#---
# ipatests/test_integration/test_nfs.py | 4 ----
# 1 file changed, 4 deletions(-)
#
#diff --git a/ipatests/test_integration/test_nfs.py b/ipatests/test_integration/test_nfs.py
#index 7272b0d44..832c56cca 100644
#--- a/ipatests/test_integration/test_nfs.py
#+++ b/ipatests/test_integration/test_nfs.py
#@@ -363,10 +363,6 @@ class TestIpaClientAutomountFileRestore(IntegrationTest):
#         cmd = self.clients[0].run_command(sha256nsswitch_cmd)
#         assert cmd.stdout_text == orig_sha256
# 
#-    @pytest.mark.xfail(
#-        reason="https://pagure.io/freeipa/issue/8189",
#-        strict=True
#-    )
#     def test_nsswitch_backup_restore_sssd(self):
#         self.nsswitch_backup_restore()
# 
#-- 
#2.26.2

From 4baf6b292f28481ece483bb8ecbd6a0807d9d45a Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Wed, 29 Jul 2020 17:57:53 +0200
Subject: [PATCH] ipatests: fix test_authselect

Before the code fix, install/uninstall on a config without
any authselect profile was not able to restore the exact
state but configured sssd profile instead.

Now that the code is doing a pre-install backup, uninstall
restores the exact state and the test needs to be updated
accordingly.

Related: https://pagure.io/freeipa/issue/8189
Reviewed-By: Francois Cami <fcami@redhat.com>
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
---
 ipatests/test_integration/test_authselect.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/ipatests/test_integration/test_authselect.py b/ipatests/test_integration/test_authselect.py
index bdf7d9f77..cba23e707 100644
--- a/ipatests/test_integration/test_authselect.py
+++ b/ipatests/test_integration/test_authselect.py
@@ -100,7 +100,9 @@ class TestClientInstallation(IntegrationTest):
             ['rm', '-f', '/etc/authselect/authselect.conf'])
         result = self._install_client()
         assert result.returncode == 0
-        assert self.msg_warn_install in result.stderr_text
+        # With the fix for 8189, there is no warning any more
+        # because install is performing a pre-install backup
+        assert self.msg_warn_install not in result.stderr_text
         # Client installation must configure the 'sssd' profile
         # with sudo
         check_authselect_profile(self.client, default_profile, ('with-sudo',))
@@ -109,12 +111,13 @@ class TestClientInstallation(IntegrationTest):
         """
         Test client un-installation when there was no authselect profile
         """
-        # As the client did not have any authselect profile before install,
-        # uninstall must print a warning about restoring 'sssd' profile
-        # by default
+        # The client did not have any authselect profile before install,
+        # but uninstall must be able to restore the backup
+        # Check that no profile is configured after uninstall
         result = self._uninstall_client()
         assert result.returncode == 0
-        check_authselect_profile(self.client, default_profile)
+        assert not self.client.transport.file_exists(
+            '/etc/authselect/authselect.conf')
 
     def test_install_client_preconfigured_profile(self):
         """
-- 
2.26.2