Skip to content

Commit

Permalink
passwd: Default no passed args. (just files now) to previous commit f…
Browse files Browse the repository at this point in the history 
…or ref
  • Loading branch information
@james-antill
james-antill committed Dec 9, 2014
1 parent 2c87684 commit d1649a4
Show file tree
Hide file tree
Showing 2 changed files with 43 additions and 29 deletions.
24 changes: 11 additions & 13 deletions src/rpmostree-compose-builtin-tree.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -979,20 +979,18 @@ rpmostree_compose_builtin_tree (int argc,

if (!rpmostree_prepare_rootfs_for_commit (yumroot, treefile, cancellable, error))
goto out;

if (opt_check_passwd)
{
if (!rpmostree_check_passwd (repo, opt_check_passwd, yumroot, treefile,
cancellable, error))
goto out;
}

if (opt_check_groups)
{
if (!rpmostree_check_groups (repo, opt_check_groups, yumroot, treefile,
cancellable, error))
goto out;
}
if (opt_check_passwd && !opt_check_groups)
g_print ("Using file for passwd checks, but previous commit for group\n");
if (!opt_check_passwd && opt_check_groups)
g_print ("Using file for group checks, but previous commit for passwd\n");

This comment has been minimized.

Sign in to view

Copy link
@cgwalters

cgwalters Dec 10, 2014

Wonder if we should make this fatal and relax later if someone has a use case. I'm having trouble of thinking of one though.

This comment has been minimized.

Sign in to view

Copy link
@james-antill

james-antill Dec 10, 2014

Author Owner

Yeh, in most cases I'd expect both or neither ... at worst we can do the trick for the sysusers problem below.

if (!rpmostree_check_passwd (repo, opt_check_passwd, yumroot, treefile,
cancellable, error))
goto out;

if (!rpmostree_check_groups (repo, opt_check_groups, yumroot, treefile,
cancellable, error))

{
const char *gpgkey;
Expand Down
48 changes: 32 additions & 16 deletions src/rpmostree-passwd-util.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -161,30 +161,36 @@ dir_contains_gid (GFile *yumroot,

static char *
load_file_direct_or_rev (OstreeRepo *repo,
const char *direct_or_rev,
const char *direct,
const char *rev,
const char *path,
GCancellable *cancellable,
GError **error)
{
gs_unref_object GFile *root = NULL;
gs_unref_object GFile *fpathd = g_file_new_for_path (direct_or_rev);
gs_unref_object GFile *fpathc = NULL;
GError *tmp_error = NULL;
char *ret = NULL;
GError *tmp_error = NULL;

ret = gs_file_load_contents_utf8 (fpathd, cancellable, &tmp_error);
if (ret)
goto out;

if (!path)
if (direct)
{
g_propagate_error (error, tmp_error);
gs_unref_object GFile *fpathd = g_file_new_for_path (direct);
ret = gs_file_load_contents_utf8 (fpathd, cancellable, error);
/* if path is passed use it, or error */
goto out;
}
g_clear_error (&tmp_error);

if (!ostree_repo_read_commit (repo, rev, &root, NULL, NULL, error))
{
if (g_error_matches (tmp_error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND))
{ /* this is kind of a hack, makes it work if it's the first commit */
g_clear_error (&tmp_error);
return g_strdup ("");
}

if (!ostree_repo_read_commit (repo, direct_or_rev, &root, NULL, NULL, error))
goto out;
g_propagate_error (error, tmp_error);
goto out;
}

fpathc = g_file_resolve_relative_path (root, path);
ret = gs_file_load_contents_utf8 (fpathc, cancellable, error);
Expand Down Expand Up @@ -247,13 +253,14 @@ compare_passwd_ents (gconstpointer a, gconstpointer b)
*/
gboolean
rpmostree_check_passwd (OstreeRepo *repo,
const char *direct_or_rev,
const char *direct,
GFile *yumroot,
JsonObject *treedata,
GCancellable *cancellable,
GError **error)
{
gboolean ret = FALSE;
const char *ref;
gs_unref_object GFile *new_path = g_file_resolve_relative_path (yumroot, "usr/lib/passwd");
gs_unref_ptrarray GPtrArray *ignore_removed_users = NULL;
gboolean ignore_all_removed = FALSE;
Expand All @@ -264,8 +271,12 @@ rpmostree_check_passwd (OstreeRepo *repo,
unsigned int oiter = 0;
unsigned int niter = 0;

ref = _rpmostree_jsonutil_object_require_string_member (treedata, "ref",
error);
if (!ref)
goto out;
old_contents = load_file_direct_or_rev (repo,
direct_or_rev, "usr/lib/passwd",
direct, ref, "usr/lib/passwd",

This comment has been minimized.

Sign in to view

Copy link
@cgwalters

cgwalters Dec 10, 2014

There's going to be a point where we stop using usr/lib/passwd - see coreos#49 . What I'm a little uncertain about is how we manage that transition point. After that though, I think for new installs we won't need the server-side checking code anymore. But if we wanted to handle upgrades we'd have to basically pre-seed systemd-sysusers on the compose side with the uids we expect.

What I'm getting at is right now this code will error out if the previous tree doesn't have usr/lib/passwd. We'll need a way to signal that transition point. Maybe the most realistic thing is a treefile option?

This comment has been minimized.

Sign in to view

Copy link
@james-antill

james-antill Dec 10, 2014

Author Owner

So the obvious workaround is to pass --check-passwd=/dev/empty after we make the change, until we can change the defaults (or remove the code) ... although that will get tiring/annoying if it's a decent amount of time.

We could also treat the file not existing in the commit as a warning, at least I'm failing to come up with a way that this could go horribly wrong.
cancellable, error);
if (!old_contents)
goto out;
Expand Down Expand Up @@ -426,13 +437,14 @@ compare_group_ents (gconstpointer a, gconstpointer b)
*/
gboolean
rpmostree_check_groups (OstreeRepo *repo,
const char *direct_or_rev,
const char *direct,
GFile *yumroot,
JsonObject *treedata,
GCancellable *cancellable,
GError **error)
{
gboolean ret = FALSE;
const char *ref;
gs_unref_object GFile *new_path = g_file_resolve_relative_path (yumroot, "usr/lib/group");
gs_unref_ptrarray GPtrArray *ignore_removed_groups = NULL;
gboolean ignore_all_removed = FALSE;
Expand All @@ -443,8 +455,12 @@ rpmostree_check_groups (OstreeRepo *repo,
unsigned int oiter = 0;
unsigned int niter = 0;

ref = _rpmostree_jsonutil_object_require_string_member (treedata, "ref",
error);
if (!ref)
goto out;
old_contents = load_file_direct_or_rev (repo,
direct_or_rev, "usr/lib/group",
direct, ref, "usr/lib/group",
cancellable, error);
if (!old_contents)
goto out;
Expand Down

0 comments on commit d1649a4

Please sign in to comment.