rpm-ostree

Author SHA1 Message Date

Author	SHA1	Message	Date
Colin Walters	a9c8b1fae1	ex-container: Make /etc/shadow 0400 on import, not post-checkout Switching to the `_CONSUME` flag revealed an "oh god how did I write that" bug in the previous patch in https://github.com/projectatomic/rpm-ostree/pull/1046 AKA commit: `334f0b89be` The way that actually fixed the bug before was because we were using hardlink checkouts, and we were operating outside an `rofiles-fuse` context, we simply directly changed the on-disk object mode. But with the `_CONSUME` flag we started deleting the files as we write, meaning that stopped working. I initially wrote a patch to do the same split "prepare/processing/commit" flow that treecompose and package layering do, but that can't really fix this bug - we need to do it on import. So do the chmod on import and drop the postprocessing bits. Closes: #1067 Approved by: jlebon	2017-10-18 17:07:54 +00:00
Colin Walters	334f0b89be	ex-container: Make /usr/etc/{,g}shadow user-readable For the `ex container` case, there's no security issues here; one shouldn't be doing user management in these roots at all. This is for work on exporting `ex container` roots to OCI as non-root. Without this fix, libostree just tries to `openat()` the object for export to tar, and fails. See also https://github.com/projectatomic/rpm-ostree/issues/1045 Closes: #1046 Approved by: jlebon	2017-10-10 20:42:55 +00:00
Colin Walters	1acd834104	Add test infra for `ex container`, and one test for bash We have some unit-style tests that run `ex container`, but they aren't "real"; they don't use scripts for example. Let's add tests for this similar to `tests/compose`. We use a 26 base, but the target repos need to be 27 to pick up the fix for: https://bugzilla.redhat.com/show_bug.cgi?id=1478172 Add some bits to share infra between `tests/compose` and `tests/ex-container`; basically handling the rpmmd repos. I tweaked things to be more streamlined there between the `.papr.yml` and the test script. Right now this is just one test for `bash`, but lays some of the infrastructure for doing more. One thing that we need to do to improve more here is to better cache RPMs, a bit like the compose tests do. Closes: #1024 Approved by: jlebon	2017-10-02 18:04:24 +00:00

Colin Walters

a9c8b1fae1

ex-container: Make /etc/shadow 0400 on import, not post-checkout

Switching to the `_CONSUME` flag revealed an "oh god how did I write that"
bug in the previous patch in https://github.com/projectatomic/rpm-ostree/pull/1046
AKA commit: 334f0b89be

The way that actually fixed the bug before was because we were using
hardlink checkouts, and we were operating outside an `rofiles-fuse`
context, we simply directly changed the on-disk object mode.

But with the `_CONSUME` flag we started deleting the files as we write,
meaning that stopped working.

I *initially* wrote a patch to do the same split "prepare/processing/commit"
flow that treecompose and package layering do, but that can't really fix this
bug - we need to do it on import.

So do the chmod on import and drop the postprocessing bits.

Closes: #1067
Approved by: jlebon

2017-10-18 17:07:54 +00:00

Colin Walters

334f0b89be

ex-container: Make /usr/etc/{,g}shadow user-readable

For the `ex container` case, there's no security issues here; one shouldn't be
doing user management in these roots at all.

This is for work on exporting `ex container` roots to OCI as non-root. Without
this fix, libostree just tries to `openat()` the object for export to tar, and
fails.

See also https://github.com/projectatomic/rpm-ostree/issues/1045

Closes: #1046
Approved by: jlebon

2017-10-10 20:42:55 +00:00

Colin Walters

1acd834104

Add test infra for ex container, and one test for bash

We have some unit-style tests that run `ex container`, but
they aren't "real"; they don't use scripts for example.  Let's
add tests for this similar to `tests/compose`.

We use a 26 base, but the target repos need to be 27
to pick up the fix for: https://bugzilla.redhat.com/show_bug.cgi?id=1478172

Add some bits to share infra between `tests/compose` and `tests/ex-container`;
basically handling the rpmmd repos. I tweaked things to be more streamlined
there between the `.papr.yml` and the test script.

Right now this is just one test for `bash`, but lays some of the infrastructure
for doing more. One thing that we need to do to improve more here is to better
cache RPMs, a bit like the compose tests do.

Closes: #1024
Approved by: jlebon

2017-10-02 18:04:24 +00:00

3 Commits