Re: Extending fcopy
Am Sonntag, 10. Dezember 2006 19:25 schrieb Michael Tautschnig:
Am Freitag, 8. Dezember 2006 16:48 schrieben Sie:
- some -k/--keep option (which I'd rather call --keep-permissions
:-)
[...]
If a file permission get borked it will never be fixed by an
softupdate.
you don't need to use the -k (keep-permissions) option, so spftupdate can
fix it. But why should it be broken anyway?
Never trust your system. Never.
Your are right, but that doesn't mean to use FAI to make it more trustworthy.
If something/someone changes permissions on your system it should be detected
by something like an IDS and not corrected silently by FAI softupdate.
In the case that it's not root:root 644 it has in most cases a special
reason. If the file is missing there noting to preserve, what to use
then?
then use -M, -m or source file permissions as it is right now.
I'd say the patch should add 2 warning:
- One to be displayed in case there is destination file
- Anotherone in the man page: WARNING: -k might introduce a security hole
in case the permissions of the destination file have been altered
unexpectedly.
good idea. Warnings are always useful.
Then, well, it's up to the FAI-user to use -k or not.
exactly.
Return codes and fcopy to me is a somewhat strange thing. The current
default behaviour is that preserving a file is treated as an error and a
non-zero exit status is returned.
In my opinion fcopy should only return something other than 0 if an error
occurred. And preserving a file is not an error IMHO.
As such I'd go for the following: Return 0 unless anything inside fcopy
(which includes preinst/postinst) went wrong. To find out, whether files
have been altered or not (which includes changing permissions), I'd prefer
an output like the following (more or less proper perl, but I guess you get
the idea):
if( $changed )
{
printf fcopy is updating $file:\n;
printf \t Copied $src to $dest\n if( $copied );
printf \t Permissions set to $perm\n if( $perm_changed );
}
I would rather stick to the output fcopy uses today. I don't think that we
need to distinguish between content and permission change. A script could
always analyze the situation further if it needs more information.
Then, one could do the following:
fcopy ... /etc/postgresql | grep -q fcopy is updating
/etc/init.d/postgresql restart
Yes, i guess you are right. I just started to do some test with fcopy
returning useful exit codes but it is rather strange. Just printing out
what has changed is a rather small patch.
kind regards,
Janning
Best,
Michael
--
PLANWERK 6 websolutions
Venloer Straße 8, 40477 Düsseldorf
Tel: (0211) 302666-0
Fax: (0211) 302666-10
http://www.planwerk6.de/
Re: Extending fcopy
Am Freitag, 8. Dezember 2006 16:48 schrieben Sie: - some -k/--keep option (which I'd rather call --keep-permissions :-) [...] If a file permission get borked it will never be fixed by an softupdate. you don't need to use the -k (keep-permissions) option, so spftupdate can fix it. But why should it be broken anyway? In the case that it's not root:root 644 it has in most cases a special reason. If the file is missing there noting to preserve, what to use then? then use -M, -m or source file permissions as it is right now. [...] i tried to use exit code, too: [...] this way you can say fcopy ... /etc/postgresql /etc/init.d/postgresql restart || exit 1; What do you think about using exit codes? First i sort it's not unix like, but diff does like this, too. Add $? to your prompt and you'll see that much more apps do it like this ;) So both methods can coexists with file list turned on (or off) with a file an option. i switched this behaviour now after some tests. My patched fcopy now returns 0 if no files were changed or 1 if files were changed. I changed because if fcopy returns exit code 1 when nothing was changed it was propagated as the script exit code. But i am still not sure what is nicer, to return exit code 1 if files were changed or return exit code 1 if files were NOT changed. kind regards janning
setup_harddisk and softupdate
Hi, i am using FAI for a few servers only by calling softupdate as the servers are pre-installed already and i have no control over the boot sequence. I have two disks, one is used and formatted for the pre-installed system, the second disk is unused. Now i wrote a hook softupdate.CLASS to run setup_harddisk, which just calls /usr/lib/fai/sbin/setup_harddisks -X My disk_config looks like this: disk_config sdb primary /media/sdb15- ; -c -j ext3 lazyformat primary /media/sdb25- ; -c -j ext3 lazyformat primary /media/sdb35- ; -c -j ext3 lazyformat I dropped disk_config sda as this disk should not be touched at all. Fine. But i am a little bit solicitous about my data. I would like to run the hook only the first time softupdate is called. But as i am runing softupdate i can't tell if it was called the first time on this server or a secondtime. Or is there any truly reliable method to decide if softupdate run before and therefore we won't call /usr/lib/fai/sbin/setup_harddisks? Maybe i can check -f /var/log/fai/FAI_CLASSES Do you have any hints? What can go wrong? I don't want to loose my data. I want to be sure that my harddisk won't be formatted if it is already in use. kind regards janning
Re: fcopy
Am Dienstag, 5. Dezember 2006 21:04 schrieb Michael Tautschnig: On Tue, 5 Dec 2006 15:46:35 +0100, Janning Vygen [EMAIL PROTECTED] said: If i fcopy a file which is alread there with same content, but the file in SOURCE has other file access permissions, why it is not copied? I should be copied, but the permissions should be changed. Which fcopy are you using? Maybe try fcopy -vD to get debuggin and verbose output. Why does fcopy compares files only literally? Maybe a small bug. But first try -D for debugging output. If you join the IRC channel #fai on oftc.net and paste your output to paste.debian.net we may help you very quickly. Did you solve this issue already? Otherwise this is probably just what #360184 is about: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=360184 Yes, it seams to be the same bug. And it's still there in the newest version. IMHO this is a bug to worry about if you use softupdate, which can result in a security hole: i chmod a script executable in /etc/network/if-pre-up.d/ which contains iptables statements. Tthe executable flag was NOT copied and so my firewall is not in the state it should be. chmod a script can be an easy way to enable/disable a part of a firewall. This bug might be only a problem with softupdate of course. I am debugging fcopy at the moment and will send my patch today. kind regards, janning -- PLANWERK 6 websolutions Venloer Straße 8, 40477 Düsseldorf Tel: (0211) 302666-0 Fax: (0211) 302666-10 http://www.planwerk6.de/
Fcopy patch regarding debian bug report #360184
Hi fai,
attached there are two patch files for fcopy, one for debian stable version
and one for the latest from fai (which send Thomas Lange to me yesterday)
These Patch files should fix the bug
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=360184
In case only the modes are changed, but the actual file stays the same,
these changes are not propagated; a possible workaround is IMHO
to call set_mode even if a file is preserved.
It just fixes the part of code where $opt_update is not set as i do not
understood what -p really does.
the main difference is in this line
if ( compare($tmpfile,$destfile) or compare_mode($ps,$destfile,$class)) {
instead of
if ( compare($tmpfile,$destfile) ){
There are a few new subroutines:
sub get_sourcefile_mode
sub get_destfile_mode
sub compare_mode
and some minor modifications to
sub set_mode
to use these new subroutines and avoid repeated code.
It was tested a few times in my environment and it works for me, but maybe
won't work for you.
i hope it works and will help anybody. Feel free to use/modify/discard but
don't claim me for any bugs.
Can anybody review this patch and maybe upload it to http://bugs.debian.org/
as i am not used to handle bug reporting databases.
kind regards
Janning
PS: i hope its allowed to send attachments to the list. netiquette is still a
TODO on
http://faiwiki.informatik.uni-koeln.de/index.php/Linux-fai_mailing_list_infos
--- fcopy 2006-12-06 11:49:47.306784009 +0100
+++ fcopy.deb31.fixed 2006-12-06 11:47:56.833502527 +0100
@@ -123,8 +123,7 @@
}
} else {
# compare literally
-
-if ( compare($sourcefile,$destfile)) {
+if ( compare($sourcefile,$destfile) or compare_mode($ps,$destfile,$class)) {
$logcomment=\t# new (literal);
} else {
$logcomment=\t# preserved (literal) if $logfile;
@@ -187,26 +186,55 @@
sub set_mode {
# set target file's owner, group, mode and time
- # use owner,group,mode from -m or from the file file-modes or
- # use the values from the source file
my ($sourcefile,$destfile,$class) = @_;
+ my ($uid,$gid,$mode,$stime) = get_sourcefile_mode($sourcefile,$class);
+ warn chown/chmod u:$uid g:$gid m:$mode $destfile\n if $debug;
+ chown ($uid,$gid, $destfile) || ewarn(chown $uid, $gid $destfile failed. $!);
+ chmod ($mode, $destfile) || ewarn(chmod $mode $destfile failed. $!);
+ utime ($stime,$stime, $destfile) || ewarn(utime for $destfile failed. $!);
+}
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+sub get_sourcefile_mode {
+
+ # owner,group,mode from -m or from the file file-modes or
+ # the values from the source file
+ my ($sourcefile,$class) = @_;
my ($uid,$gid,$owner,$group,$mode);
# get mtime,uid,gid,mode from source file
my ($stime,@defmodes) = (stat($sourcefile/$class))[9,4,5,2];
-
if ($modeset) { # use -m values
($owner,$group,$mode) = @opt_modes;
} elsif (-f $sourcefile/file-modes){
($owner,$group,$mode) = read_file_mode($sourcefile/file-modes,$class);
} else { # use values from source file
($owner,$group,$mode) = @defmodes;
+# see perldoc -f stat
+$mode = $mode 0;
}
-
($uid,$gid) = name2num($owner,$group);
- warn chown/chmod u:$uid g:$gid m:$mode $destfile\n if $debug;
- chown ($uid,$gid, $destfile) || ewarn(chown $owner $group $destfile failed. $!);
- chmod ($mode, $destfile) || ewarn(chmod $mode $destfile failed. $!);
- utime ($stime,$stime, $destfile) || ewarn(utime for $destfile failed. $!);
+ return ($uid,$gid,$mode,$stime);
+}
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+sub get_destfile_mode {
+
+ my $destfile = shift;
+ my ($owner,$group,$mode,$time) = (stat($destfile))[4,5,2,9];
+ my ($uid,$gid) = name2num($owner,$group);
+ # see perldoc -f stat
+ $mode = $mode 0;
+ return ($uid,$gid,$mode,$time);
+}
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+sub compare_mode {
+
+ # compare destination file's mode with source
+ # return 1 if differs / 0 if equals
+ my ($sourcefile,$destfile,$class) = @_;
+ my ($suid,$sgid,$smode,$stime) = get_sourcefile_mode($sourcefile,$class);
+ my ($duid,$dgid,$dmode,$dtime) = get_destfile_mode($destfile);
+
+ return 1 if ( $suid != $duid or $sgid != $dgid or $smode != $dmode or $stime != $dtime );
+ return 0;
}
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
sub check_mopt {
--- fcopy 2006-12-06 11:19:47.0 +0100
+++ fcopy.fixed 2006-12-06 11:19:47.0 +0100
@@ -145,7 +145,7 @@
runscript(preinst,$ps,$tmpfile,$class);
};
-if ( compare($tmpfile,$destfile)) {
+if ( compare($tmpfile,$destfile) or compare_mode($ps,$destfile,$class)) {
$logcomment=\t# new (literal);
} else {
$logcomment=\t# preserved (literal) if $logfile;
@@ -246,27 +246,56 @@
sub set_mode {
# set target file's owner, group, mode and time
- # use owner,group,mode from -m
fcopy feature request: report if a file was copied
hi, as i use softupdate a lot , it would be nice to have a fcopy feature which reports if any files or file permissions were changed. Look at my script in BASE/50-ntp #!/bin/sh fcopy -iM /etc/ntp.conf /etc/init.d/ntp-server stop ntpd -q -g hwclock --systohc /etc/init.d/ntp-server start I dont want to start and stop my ntp server on each softupdate, only on my first install or when /etc/ntp.conf changes it would be nice to have something like this: if [ `fcopy -iM /etc/ntp.conf` -gt 0 ] then /etc/init.d/ntp-server stop ntpd -q -g hwclock --systohc /etc/init.d/ntp-server start fi it would be nice to have an option like -n --number report number of files changed and let fcopy report the number of files changed i would like to write a patch for fcopy implementing this if it does make sense and would become part of fai. kind regards Janning -- PLANWERK 6 websolutions Venloer Straße 8, 40477 Düsseldorf Tel: (0211) 302666-0 Fax: (0211) 302666-10 http://www.planwerk6.de/
Re: fcopy feature request: report if a file was copied
Am Mittwoch, 6. Dezember 2006 15:35 schrieb Thomas Lange: On Wed, 6 Dec 2006 15:23:58 +0100, Janning Vygen [EMAIL PROTECTED] said: if [ `fcopy -iM /etc/ntp.conf` -gt 0 ] it would be nice to have an option like -n --number report number of files changed and let fcopy report the number of files changed Good idea. thanks. But then fcopy must not write any error or verbose messages when using -n. Or should -n report the number of files changes using the exit/return code? we have two options: - using error code: i thought about using return code first, but isn't it a little bit non-unix-stlye to use exit code for reporting? - using stdout: we could print verbose messages to stderr with warn and use stdout only for reporting number of files. i think using stdout is best, just reporting a number. The script could even build a nice report with -R full to send to administrator showing diffs and chmod/chown/utime if you get output with -R something was changed, so you can always reload the daemon. so my proposal would be: 1. send all verbose output to stderr 2. create a new option --report [number|filenames|full|mail] number (default if -R is given): reports number of file changes to stdout filenames list all files which has changed one per line full list all files and their differences of content or modes mail sends full report to stdout and [EMAIL PROTECTED] But i am unsure how to name the option as -r is already used, as -l --list and -c --count are used, too. kind regards Janning
Re: fcopy feature request: report if a file was copied
Am Mittwoch, 6. Dezember 2006 16:13 schrieb Michael Tautschnig: hi, as i use softupdate a lot , it would be nice to have a fcopy feature which reports if any files or file permissions were changed. Look at my script in BASE/50-ntp [...] I guess postinst is what you really want (and it is already there, after all). See the man page. you are right, but - postinst is called for every file which is copied - However, the permission thing is obviously not captured (yet). Best, Michael -- PLANWERK 6 websolutions Venloer Straße 8, 40477 Düsseldorf Tel: (0211) 302666-0 Fax: (0211) 302666-10 http://www.planwerk6.de/
Re: fcopy feature request: report if a file was copied
Am Mittwoch, 6. Dezember 2006 16:46 schrieb Janning Vygen: Am Mittwoch, 6. Dezember 2006 16:13 schrieb Michael Tautschnig: hi, as i use softupdate a lot , it would be nice to have a fcopy feature which reports if any files or file permissions were changed. Look at my script in BASE/50-ntp [...] I guess postinst is what you really want (and it is already there, after all). See the man page. you are right, but - postinst is called for every file which is copied sorry, i clicked return-enter to early. my second reason why i don't like postinst: - its more transparent to have it inside the script which fcopies the files. kind regards janning
another fcopy feature request -k --keep-modes
sometimes i don't care about the owner:group:modes:timestamp example /etc/ssh/sshd_config. I just want to copy my content to /etc/ssh/sshd_config, but owner, group and modes should be kept. Of course i can add -m but then i need to know the correct permissions and ownership of each file i want to change. I just want to copy a new file and KEEP the original file modes and ownerships. with fcopy you have -m -M or modes from source file. but It would be nice to have -k --keep-modes[=owner,group,modes,time] to keep all or named file stats from the original file i can write a patch if it sounds reasonable. kind regards Janning
Re: fcopy feature request: report if a file was copied
Am Mittwoch, 6. Dezember 2006 17:01 schrieben Sie: Am Mittwoch, 6. Dezember 2006 16:13 schrieb Michael Tautschnig: hi, as i use softupdate a lot , it would be nice to have a fcopy feature which reports if any files or file permissions were changed. Look at my script in BASE/50-ntp [...] I guess postinst is what you really want (and it is already there, after all). See the man page. you are right, but - postinst is called for every file which is copied - Which is what you intended, as I understood it - this does _not_ mean that postinst is called for every file that fcopy is run on, but only in those cases where the file is _really_ copied, i.e., overwritten. yes but imagine fcopy -ir /etc/postfix/ and i need a postinst script with /etc/init.d/postfix reload i have to place postinst inside /etc/postfix/main.cf/BASE/postinst /etc/postfix/master.cf/BASE/postinst right? and if i did change master.conf and main.conf postinst would be called two times. and what if i have 30 files or more in /etc/postfix like virtual tables ... with my approach it would be `fcopy -irR /etc/postfix/` -gt 0 /etc/init.d/postfix reload (maybe this is not correct bash syntax, just example code ) kind regards Janning
fcopy
Hi, i have read the fcopy man page and didn't find a hint on the following problem: If i fcopy a file which is alread there with same content, but the file in SOURCE has other file access permissions, why it is not copied? I even tried to set the permissions with -m but no way. If the file is given and has the same content, nothing is copied but preserved as fcopy states. I would expect fcopy to copy the file if anything like content or permissions has changed. Ok, it is somewhat explaind in the -p option but i don't have a changelog file. I have no nfsroot and no cvs, i just rsync my /fai to the remote server and run 'fai -N softupdate'. And if i change file access permissions they are not copied which is bad in my opinion. Why does fcopy compares files only literally? kind regards Janning
Re: Anfängerfrage
Am Mittwoch, 29. November 2006 20:28 schrieben Sie: Hi, On Wednesday 29 November 2006 19:41, Janning Vygen wrote: Bei einigen Konfigurationen von Datenbankservern ist es wichtig zu partionieren. Kann man beim softupdate irgendwie trotzdem partionieren? Ja, mittels hooks. ok, danke. Ich habe auch gerade mein erstes softupdate durchgeführt. Jetzt habe ich aber auch diesen Thread bezüglich Servern gefunden, die man weder per CD noch Netz botten kann und der scheint mir sehr passend für mich zu sein: http://www.mail-archive.com/linux-fai@rrz.uni-koeln.de/msg03279.html Dort wird FAI auf der Ramdsik gebootet. Das scheint perfekt für mich zu sein, da ich kein NFS brauche und mir einfach mein Image einmal als initrd.gz bastel und auf jedem Server das nur hochladen brauch, den bootloader anpasse und ein reboot installiert mir dann die ganze Kiste. Wenn ich das richtig verstehe, dass das die Lösung für alle FAI User bei Hostingprovidern ist, dann sollte das unbedingt mit ins Handbuch! Was ich in dem Thread nur nicht ganz verstehe ist die kernel option ip kernel [...] ip=192.168.1.1demohost::off [...] Das kann ja so wohl nur als Beispiel gemeint sein. Da ich bei meinem Hostingprovider kein dhcp habe, sondern mein eth0 statisch konfiguriere, muss ich da vermutlich ip/netzmaske/gateway/hostname eintragen, also ungefähr so?? kernel [...] ip=IP:BROADCAST:NETMASK:GATEWAY:HOSTNAME::off [...] Wo finde ich die Doku zu dem Kernel parameter ip? Gruß Janning -- PLANWERK 6 websolutions Venloer Straße 8, 40477 Düsseldorf Tel: (0211) 302666-0 Fax: (0211) 302666-10 http://www.planwerk6.de/
Re: AW: Re: Anf*ngerfrage
Am Donnerstag, 30. November 2006 14:58 schrieb Thomas Memenga: Hi Janning, fallst du deine Server bei hetzner hast: Lass es mich wissen ob du das hin bekommst. ja, ich habe die server bei hetzner. wenn ich alles fertig habe, werd eich da gerne ein howto draus machen. Ich habe per ramdisk vor ein paar Monaten meine Server bei Hetzner installiert, jedoch bekomme ich jetzt aus dem Rescue-System nicht mehr grub installiert. und mit Lilo funzt das irgendwie auch nicht. du brauchst das rescue system doch gar nicht. du kannst es doch aus dem normalen system heraus machen Ich hab es damals noch ein bischen anders gemacht als in der Mailingliste beschrieben. [...] Ok, das probiere ich mal, falls der andere weg nicht klappt. ist aber ja im Prinzip dasselbe, wie in dem Thread: http://www.mail-archive.com/linux-fai@rrz.uni-koeln.de/msg03279.html Was ich in dem Thread nur nicht ganz verstehe ist die kernel option ip kernel [...] ip=192.168.1.1demohost::off [...] Da streibt mich zur Zeit um: Wie finde ich die passenden kernel options heraus? Gruß Janning -- PLANWERK 6 websolutions Venloer Straße 8, 40477 Düsseldorf Tel: (0211) 302666-0 Fax: (0211) 302666-10 http://www.planwerk6.de/
Re: AW: Re: Anf*ngerfrage
Am Donnerstag, 30. November 2006 15:09 schrieb Janning Vygen: kernel [...] ip=192.168.1.1demohost::off [...] Da streibt mich zur Zeit um: Wie finde ich die passenden kernel options heraus? gerade selbst entdeckt: man mus snur im FAI Guide nachlesen (3.3 Creating a boot floppy), dort ist der Verweis auf /usr/src/linux/Documentation/nfsroot.txt Gruß Janning
Re: Anfängerfrage
Am Donnerstag, 30. November 2006 14:56 schrieb Holger Levsen: Hi, On Thursday 30 November 2006 13:26, Janning Vygen wrote: http://www.mail-archive.com/linux-fai@rrz.uni-koeln.de/msg03279.html Dort wird FAI auf der Ramdsik gebootet. [...] Also ich lebe wunderbar mit reinen softupdates, ja, aber du kannst ja nicht die ganze Platte partionieren, wenn da schon dein debian drauf läuft, auch nicht mit hooks! Denn sonst zerschießt Du dir ja Dein ganzes System. Ansonsten wäre ich mit softupdate auch völlig zufrieden. aber wenn Du uns patches fürs Handbuch schickst (und die taugen), nehmen wir die sehr gerne an+auf :) ich versuchs! Wo finde ich die Doku zu dem Kernel parameter ip? $kernel_source/Documentation/nfsroot.txt ok und es steht sogar im Handbuch, wie ich 10 Sekunden vor Eintreffen deiner mail gesehen habe. Unter creating a boot floppy mit link auf $kernel_source/Documentation/nfsroot. Danke für Deine schnelle Hilfe. Gruß Janning
Re: Anfängerfrage
Am Mittwoch, 29. November 2006 17:47 schrieb Holger Levsen: Im Prinzip habe ich aber mit dem Rescuesystem (debian 3.1) aber ja genau das Startsystem, was notwendig ist im RAM. Kann man vom Rescuesystem aus, die weitere Installation starten? Oder anders formuliert: Kann man FAI auch dann sinnvoll nutzen, wenn man keinen Einfluß auf die Art des Bootvorgangs hat? Und wenn ja, wie? Mach ein softupdate mit FAI, softupdate steht auch im Handbuch beschrieben (update bestehender systeme oder so heisst das Kapitel). Das ist wie ne FAI-Installation, allerdings ohne booten und Platte formatieren ;-) Nutze ich ständig, klappt wunderbar. Ok, danke für die ausführliche und schnelle Hilfe. softupdate hatte ich auch schon gesehen und auch Eure Seite dazu http://layer-acht.org/fai/softupdates/ Dazu zwei Fragen: Bei einigen Konfigurationen von Datenbankservern ist es wichtig zu partionieren. Kann man beim softupdate irgendwie trotzdem partionieren? Kann man beim softupdate die Konfigurationen zentral halten über cvs? Gruß Janning Du mußt nur fai -N softupdate aufrufen, nicht fai softupdate, weil ja noch nie Klassen definiert wurden. Ich nutz das auch so. Ich hoffe meine Frage macht halbwegs Sinn für Euch Experten. Jup :) Gruß, Holger -- PLANWERK 6 websolutions Venloer Str. 8, 40477 Düsseldorf Tel: (0211) 302666-0 Fax: (0211) 302666-10 http://www.planwerk6.de/
