190 lines
7.6 KiB
Diff
190 lines
7.6 KiB
Diff
From ca880cfb117fc870a6e2710b9e31b2f67d5651e1 Mon Sep 17 00:00:00 2001
|
|
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
Date: Wed, 29 Jul 2020 13:35:49 +0200
|
|
Subject: [PATCH] ipa-client-install: use the authselect backup during
|
|
uninstall
|
|
|
|
When ipa-client-install is run on a system with no existing
|
|
authselect configuration (for instance a fedora 31 new install),
|
|
uninstallation is picking sssd profile but this may lead to
|
|
a configuration with differences compared to the pre-ipa-client
|
|
state.
|
|
|
|
Now that authselect provides an option to backup the existing
|
|
configuration prior to setting a profile, the client install
|
|
can save the backup name and uninstall is able to apply the
|
|
backup in order to go back to the pre-ipa-client state.
|
|
|
|
Fixes: https://pagure.io/freeipa/issue/8189
|
|
Reviewed-By: Francois Cami <fcami@redhat.com>
|
|
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
|
|
---
|
|
ipaplatform/redhat/authconfig.py | 37 ++++++++++++++------------------
|
|
1 file changed, 16 insertions(+), 21 deletions(-)
|
|
|
|
diff --git a/ipaplatform/redhat/authconfig.py b/ipaplatform/redhat/authconfig.py
|
|
index 758376f2b..89f452d66 100644
|
|
--- a/ipaplatform/redhat/authconfig.py
|
|
+++ b/ipaplatform/redhat/authconfig.py
|
|
@@ -27,6 +27,7 @@ from ipaplatform.paths import paths
|
|
from ipapython import ipautil
|
|
from ipapython.admintool import ScriptError
|
|
import os
|
|
+import time
|
|
|
|
FILES_TO_NOT_BACKUP = ['passwd', 'group', 'shadow', 'gshadow']
|
|
|
|
@@ -103,28 +104,16 @@ class RedHatAuthSelect(RedHatAuthToolBase):
|
|
def configure(self, sssd, mkhomedir, statestore, sudo=True):
|
|
# In the statestore, the following keys are used for the
|
|
# 'authselect' module:
|
|
+ # Old method:
|
|
# profile: name of the profile configured pre-installation
|
|
# features_list: list of features configured pre-installation
|
|
# mkhomedir: True if installation was called with --mkhomedir
|
|
# profile and features_list are used when reverting to the
|
|
# pre-install state
|
|
- cfg = self._parse_authselect_output()
|
|
- if cfg:
|
|
- statestore.backup_state('authselect', 'profile', cfg[0])
|
|
- statestore.backup_state(
|
|
- 'authselect', 'features_list', " ".join(cfg[1]))
|
|
- else:
|
|
- # cfg = None means that the current conf is not managed by
|
|
- # authselect but by authconfig.
|
|
- # As we are using authselect to configure the host,
|
|
- # it will not be possible to revert to a custom authconfig
|
|
- # configuration later (during uninstall)
|
|
- # Best thing to do will be to use sssd profile at this time
|
|
- logger.warning(
|
|
- "WARNING: The configuration pre-client installation is not "
|
|
- "managed by authselect and cannot be backed up. "
|
|
- "Uninstallation may not be able to revert to the original "
|
|
- "state.")
|
|
+ # New method:
|
|
+ # backup: name of the authselect backup
|
|
+ backup_name = "pre_ipaclient_{}".format(time.strftime("%Y%m%d%H%M%S"))
|
|
+ statestore.backup_state('authselect', 'backup', backup_name)
|
|
|
|
cmd = [paths.AUTHSELECT, "select", "sssd"]
|
|
if mkhomedir:
|
|
@@ -133,6 +122,7 @@ class RedHatAuthSelect(RedHatAuthToolBase):
|
|
if sudo:
|
|
cmd.append("with-sudo")
|
|
cmd.append("--force")
|
|
+ cmd.append("--backup={}".format(backup_name))
|
|
|
|
ipautil.run(cmd)
|
|
|
|
@@ -179,10 +169,15 @@ class RedHatAuthSelect(RedHatAuthToolBase):
|
|
else:
|
|
features = []
|
|
|
|
- cmd = [paths.AUTHSELECT, "select", profile]
|
|
- cmd.extend(features)
|
|
- cmd.append("--force")
|
|
- ipautil.run(cmd)
|
|
+ backup = statestore.restore_state('authselect', 'backup')
|
|
+ if backup:
|
|
+ cmd = [paths.AUTHSELECT, "backup-restore", backup]
|
|
+ ipautil.run(cmd)
|
|
+ else:
|
|
+ cmd = [paths.AUTHSELECT, "select", profile]
|
|
+ cmd.extend(features)
|
|
+ cmd.append("--force")
|
|
+ ipautil.run(cmd)
|
|
|
|
def backup(self, path):
|
|
current = self._get_authselect_current_output()
|
|
--
|
|
2.26.2
|
|
|
|
# Not needed for 4.7.8 release
|
|
#
|
|
#From 3eaab97e317584bc47d4a27a607267ed90df7ff7 Mon Sep 17 00:00:00 2001
|
|
#From: Florence Blanc-Renaud <flo@redhat.com>
|
|
#Date: Wed, 29 Jul 2020 13:40:26 +0200
|
|
#Subject: [PATCH] ipatests: remove the xfail for test_nfs.py
|
|
#
|
|
#Related: https://pagure.io/freeipa/issue/8189
|
|
#Reviewed-By: Francois Cami <fcami@redhat.com>
|
|
#Reviewed-By: Michal Polovka <mpolovka@redhat.com>
|
|
#---
|
|
# ipatests/test_integration/test_nfs.py | 4 ----
|
|
# 1 file changed, 4 deletions(-)
|
|
#
|
|
#diff --git a/ipatests/test_integration/test_nfs.py b/ipatests/test_integration/test_nfs.py
|
|
#index 7272b0d44..832c56cca 100644
|
|
#--- a/ipatests/test_integration/test_nfs.py
|
|
#+++ b/ipatests/test_integration/test_nfs.py
|
|
#@@ -363,10 +363,6 @@ class TestIpaClientAutomountFileRestore(IntegrationTest):
|
|
# cmd = self.clients[0].run_command(sha256nsswitch_cmd)
|
|
# assert cmd.stdout_text == orig_sha256
|
|
#
|
|
#- @pytest.mark.xfail(
|
|
#- reason="https://pagure.io/freeipa/issue/8189",
|
|
#- strict=True
|
|
#- )
|
|
# def test_nsswitch_backup_restore_sssd(self):
|
|
# self.nsswitch_backup_restore()
|
|
#
|
|
#--
|
|
#2.26.2
|
|
|
|
From 4baf6b292f28481ece483bb8ecbd6a0807d9d45a Mon Sep 17 00:00:00 2001
|
|
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
Date: Wed, 29 Jul 2020 17:57:53 +0200
|
|
Subject: [PATCH] ipatests: fix test_authselect
|
|
|
|
Before the code fix, install/uninstall on a config without
|
|
any authselect profile was not able to restore the exact
|
|
state but configured sssd profile instead.
|
|
|
|
Now that the code is doing a pre-install backup, uninstall
|
|
restores the exact state and the test needs to be updated
|
|
accordingly.
|
|
|
|
Related: https://pagure.io/freeipa/issue/8189
|
|
Reviewed-By: Francois Cami <fcami@redhat.com>
|
|
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
|
|
---
|
|
ipatests/test_integration/test_authselect.py | 13 ++++++++-----
|
|
1 file changed, 8 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/ipatests/test_integration/test_authselect.py b/ipatests/test_integration/test_authselect.py
|
|
index bdf7d9f77..cba23e707 100644
|
|
--- a/ipatests/test_integration/test_authselect.py
|
|
+++ b/ipatests/test_integration/test_authselect.py
|
|
@@ -100,7 +100,9 @@ class TestClientInstallation(IntegrationTest):
|
|
['rm', '-f', '/etc/authselect/authselect.conf'])
|
|
result = self._install_client()
|
|
assert result.returncode == 0
|
|
- assert self.msg_warn_install in result.stderr_text
|
|
+ # With the fix for 8189, there is no warning any more
|
|
+ # because install is performing a pre-install backup
|
|
+ assert self.msg_warn_install not in result.stderr_text
|
|
# Client installation must configure the 'sssd' profile
|
|
# with sudo
|
|
check_authselect_profile(self.client, default_profile, ('with-sudo',))
|
|
@@ -109,12 +111,13 @@ class TestClientInstallation(IntegrationTest):
|
|
"""
|
|
Test client un-installation when there was no authselect profile
|
|
"""
|
|
- # As the client did not have any authselect profile before install,
|
|
- # uninstall must print a warning about restoring 'sssd' profile
|
|
- # by default
|
|
+ # The client did not have any authselect profile before install,
|
|
+ # but uninstall must be able to restore the backup
|
|
+ # Check that no profile is configured after uninstall
|
|
result = self._uninstall_client()
|
|
assert result.returncode == 0
|
|
- check_authselect_profile(self.client, default_profile)
|
|
+ assert not self.client.transport.file_exists(
|
|
+ '/etc/authselect/authselect.conf')
|
|
|
|
def test_install_client_preconfigured_profile(self):
|
|
"""
|
|
--
|
|
2.26.2
|
|
|