Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenSSHConfigScanner: Include directive is supported since RHEL 8.6 #1212

Merged
merged 1 commit into from
Jul 24, 2024
Merged

OpenSSHConfigScanner: Include directive is supported since RHEL 8.6 #1212

merged 1 commit into from
Jul 24, 2024

Conversation

Jakuje
Copy link
Contributor

@Jakuje Jakuje commented Apr 25, 2024

This issue could cause false positive reports when the user has the configuration options such as "Subsystem sftp" defined in included file only.

Resolves: RHEL-33902

@github-actions GitHub Actions
Copy link

Thank you for contributing to the Leapp project!

Please note that every PR needs to comply with the Leapp Guidelines and must pass all tests in order to be mergeable.
If you want to request a review or rebuild a package in copr, you can use following commands as a comment:

  • review please @oamg/developers to notify leapp developers of the review request
  • /packit copr-build to submit a public copr build using packit

Packit will automatically schedule regression tests for this PR's build and latest upstream leapp build. If you need a different version of leapp, e.g. from PR#42, use /packit test oamg/leapp#42
Note that first time contributors cannot run tests automatically - they will be started by a reviewer.

It is possible to schedule specific on-demand tests as well. Currently 2 test sets are supported, beaker-minimal and kernel-rt, both can be used to be run on all upgrade paths or just a couple of specific ones.
To launch on-demand tests with packit:

  • /packit test --labels kernel-rt to schedule kernel-rt tests set for all upgrade paths
  • /packit test --labels beaker-minimal-8.10to9.4,kernel-rt-8.10to9.4 to schedule kernel-rt and beaker-minimal test sets for 8.10->9.4 upgrade path

See other labels for particular jobs defined in the .packit.yaml file.

Please open ticket in case you experience technical problem with the CI. (RH internal only)

Note: In case there are problems with tests not being triggered automatically on new PR/commit or pending for a long time, please contact leapp-infra.

@Jakuje Jakuje force-pushed the sftp-include branch 2 times, most recently from 55212e1 to f21b4b4 Compare April 25, 2024 15:37
@pirat89
Copy link
Member

pirat89 commented Jul 2, 2024

/packit copr-build

MichalHe
MichalHe requested changes Jul 19, 2024
View reviewed changes
Copy link
Member

@MichalHe MichalHe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the high-level perspective, these changes are fine. I left minor comments regarding variable naming. If you need help with avoiding touching the filesystem in the unit tests, I can happily render my assistance.

repos/system_upgrade/common/actors/opensshconfigscanner/libraries/readopensshconfig.py Outdated Show resolved Hide resolved
repos/system_upgrade/common/actors/opensshconfigscanner/libraries/readopensshconfig.py Outdated Show resolved Hide resolved
repos/system_upgrade/common/actors/opensshconfigscanner/libraries/readopensshconfig.py Outdated Show resolved Hide resolved
...rade/common/actors/opensshconfigscanner/tests/test_readopensshconfig_opensshconfigscanner.py Outdated Show resolved Hide resolved
@Jakuje Jakuje force-pushed the sftp-include branch 2 times, most recently from 6543207 to a9a2483 Compare July 19, 2024 15:01
@MichalHe
Copy link
Member

MichalHe commented Jul 19, 2024 •
edited
Loading

@Jakuje Could the glob expression in the Include directive contain spaces? For example

Include "/home/my configs/sshd_config"

In such a case the logic would be faulty as it would try to use the pattern /home/my

A solution in such a case would be to use (this ensures that only the leftmost whitespace will be used for splitting)

el = el.split(None, 1)

@Jakuje
Copy link
Contributor Author

Jakuje commented Jul 19, 2024

@Jakuje Could the glob expression in the Include directive contain spaces? For example

Include "/home/my configs/sshd_config"

In such a case the logic would be faulty as it would try to use the pattern /home/my

A solution in such a case would be to use (this ensures that only the leftmost whitespace will be used for splitting)

el = el.split(None, 1)

Good catch! You are right. I will change it.

From the manual page of sshd_config, it can also accept several filenames one one line so that would be also good to test if this needs some special handling.

@Jakuje
Copy link
Contributor Author

Jakuje commented Jul 22, 2024

el = el.split(None, 1)

reading through the code, this wont work as in some other cases we already depend on the rest being split by spaces (such as match, subsystem). The way how the splitting is implemented in OpenSSH

https://github.com/openssh/openssh-portable/blob/master/misc.c#L2044

is something like the shell expansions so using shlex should do.

Pushed the updated change.

@MichalHe
Copy link
Member

MichalHe commented Jul 23, 2024 •
edited
Loading

/packit build

@MichalHe
Copy link
Member

I have tested the patch using the setup described in RHEL-33902 and it works like a charm. Just waiting for the tests to finish and this can be merged.

@Jakuje
OpenSSHConfigScanner: Include directive is supported since RHEL 8.6
8382e68 
This issue could cause false positive reports when the user has the
configuration options such as "Subsystem sftp" defined in included file
only.

Resolves: RHEL-33902

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Co-Authored-By: Michal Hecko <mhecko@redhat.com>

do not use filesystem during tests
@MichalHe
Copy link
Member

/packit build

@Rezney Rezney merged commit 998b774 into oamg:master Jul 24, 2024
20 checks passed
@Rezney Rezney added the changelog-checked The merger/reviewer checked the changelog draft document and updated it when relevant label Jul 24, 2024
pirat89 added a commit to pirat89/leapp-repository that referenced this pull request Aug 16, 2024
@pirat89
# Release 0.21.0
3ff50a5 
## Packaging
- .. names of packages, dependencies, changes in provided capabilities....

## Upgrade handling
### Fixes
- Add missing RHUI GCP config info for RHEL for SAP (oamg#1253)
- Fix creation of the post upgrade report about changes in states of systemd services (oamg#1210)
- Fix detection of valid sshd config with internal-sftp subsystem in Leapp (oamg#1212)
- Fix evaluation of PES data (oamg#1194)
- Fix failing "update-ca-trust" command caused by missing util-linux package (oamg#1169)
- Fix handling of versions in RHUI configuration for ELS and SAP upgrades (oamg#1240)
- Fix the parsing of the lscpu output (oamg#1184, oamg#1208)
- Fix the upgrade of systems using RHUI on AWS after changes in RHUI client package (oamg#1178)
- Fix upgrade on aarch64 via RHUI on AWS (oamg#1240)
- Handle a false positive GPG check error when TargetUserSpaceInfo is missing  (oamg#1269)
- Target by default always "GA" channel repositories unless a different channel is specified for the leapp execution (oamg#1205)
- Update the default kernel cmdline (oamg#1193, oamg#1216)
- Update the device driver deprecation data, fixing invalid fields for some AMD CPUs (oamg#1211)
- Wait for the storage initialization when /usr is on separate file system - covering SAN (oamg#1218, oamg#1219)
- [IPU 7 -> 8] Drop enforced tomcat removal for satellite when upgrading to RHEL 8.10 (oamg#1243)
- [IPU 7 -> 8] Fix detection of bootable device on RAID (oamg#1260)
- [IPU 8 -> 9] Inhibit the upgrade to RHEL 9.5 on ARM architecture due to incompatibility of the RHEL 8 bootloader and RHEL 9.5 kernel (oamg#1270)

### Enhancements
- [IPU 8 -> 9] Introduce upgrade path 8.10 -> 9.5 (oamg#1245, oamg#1246)
- Apply solutions for leftover rpms for all major upgrade paths - including experimental actors (oamg#1199)
- Do not terminate the upgrade dracut module execution anymore if /sysroot/root/tmp_leapp_py3/.leapp_upgrade_failed exists (oamg#1197)
- Improve set_systemd_services_states logging (oamg#1213)
- Include leapp command execution and defined leapp envars inside leapp.db - (oamg#1152)
- Introduce experimental upgrades in 'live' mode for the testing (oamg#1248)
- Load obsoleted GPG keys from gpg-signatures.json file instead of hardcoding them (oamg#1241)
- Several minor improvements in messages printed in console output (oamg#1173, oamg#1214, oamg#1274)
- Several minor improvements in report and error messages (oamg#1207, oamg#1217, oamg#1234, oamg#1235, oamg#1242)
- Sort lists in dnf-plugin-data for easier overview (oamg#1231)
- [IPU 7 -> 8] Allow upgrade of content from ELS repositories (oamg#1198)
- [IPU 7 -> 8] Inhibit the upgrade when Legacy GRUB is detected (oamg#1206)
- [IPU 7 -> 8] Inhibit the upgrade when embedding area is small to prevent failed bootloader update (oamg#1195)
- [IPU 8 -> 9] Enable EL 8 > 9 upgrades on Alibaba cloud (oamg#1249)
- [IPU 8 -> 9] Enable EL 8 to 9 upgrade of Satellite/Foreman server (oamg#1181)
- [IPU 9 -> 10] Introduced number of changes to enable experimental IPU 9 -> 10 (oamg#1169)
- [IPU 9 -> 10] Prevent upgrading if NetworkManager is configured with dhcp=dhclient (oamg#1268)
- [IPU 9 -> 10] Update URLs in reports to reflect the next planned major upgrade path (oamg#1169, oamg#1273)

## Additional changes interesting for devels
- drop unused `packager` field from gpg-signatures.json (oamg#1233)
- [IPU 9 -> 10] make system_upgrade/common leapp repo Python 3.12 compatible
- [IPU 9 -> 10] introduced system_upgrade/el9toel10 leapp repo
@pirat89 pirat89 mentioned this pull request Aug 16, 2024
Merged
pirat89 added a commit that referenced this pull request Aug 16, 2024
@pirat89
# Release 0.21.0 (#1282)
03c257b 
## Packaging
- Start building for EL 9 in the upstream repository on COPR (#1169)

## Upgrade handling
### Fixes
- Add missing RHUI GCP config info for RHEL for SAP (#1253)
- Fix creation of the post upgrade report about changes in states of systemd services (#1210)
- Fix detection of valid sshd config with internal-sftp subsystem in Leapp (#1212)
- Fix evaluation of PES data (#1194)
- Fix failing "update-ca-trust" command caused by missing util-linux package (#1169)
- Fix handling of versions in RHUI configuration for ELS and SAP upgrades (#1240)
- Fix the parsing of the lscpu output (#1184, #1208)
- Fix the upgrade of systems using RHUI on AWS after changes in RHUI client package (#1178)
- Fix upgrade on aarch64 via RHUI on AWS (#1240)
- Handle a false positive GPG check error when TargetUserSpaceInfo is missing  (#1269)
- Target by default always "GA" channel repositories unless a different channel is specified for the leapp execution (#1205)
- Update the default kernel cmdline (#1193, #1216)
- Update the device driver deprecation data, fixing invalid fields for some AMD CPUs (#1211)
- Wait for the storage initialization when /usr is on separate file system - covering SAN (#1218, #1219)
- [IPU 7 -> 8] Drop enforced tomcat removal for satellite when upgrading to RHEL 8.10 (#1243)
- [IPU 7 -> 8] Fix detection of bootable device on RAID (#1260)
- [IPU 8 -> 9] Inhibit the upgrade to RHEL 9.5 on ARM architecture due to incompatibility of the RHEL 8 bootloader and RHEL 9.5 kernel (#1270)

### Enhancements
- [IPU 8 -> 9] Introduce upgrade path 8.10 -> 9.5 (#1245, #1246)
- Update leapp data files (#1280)
- Apply solutions for leftover rpms for all major upgrade paths - including experimental actors (#1199)
- Do not terminate the upgrade dracut module execution anymore if /sysroot/root/tmp_leapp_py3/.leapp_upgrade_failed exists (#1197)
- Improve set_systemd_services_states logging (#1213)
- Include leapp command execution and defined leapp envars inside leapp.db - (#1152)
- Introduce experimental upgrades in 'live' mode for the testing (#1248)
- Load obsoleted GPG keys from gpg-signatures.json file instead of hardcoding them (#1241)
- Several minor improvements in messages printed in console output (#1173, #1214, #1274)
- Several minor improvements in report and error messages (#1207, #1217, #1234, #1235, #1242)
- Sort lists in dnf-plugin-data for easier overview (#1231)
- [IPU 7 -> 8] Allow upgrade of content from ELS repositories (#1198)
- [IPU 7 -> 8] Inhibit the upgrade when Legacy GRUB is detected (#1206)
- [IPU 7 -> 8] Inhibit the upgrade when embedding area is small to prevent failed bootloader update (#1195)
- [IPU 8 -> 9] Enable EL 8 > 9 upgrades on Alibaba cloud (#1249)
- [IPU 8 -> 9] Enable EL 8 to 9 upgrade of Satellite/Foreman server (#1181)
- [IPU 9 -> 10] Introduced number of changes to enable IPU 9 -> 10 for testing (#1169)
- [IPU 9 -> 10] Prevent upgrading if NetworkManager is configured with dhcp=dhclient (#1268)
- [IPU 9 -> 10] Update URLs in reports to reflect the next planned major upgrade path (#1169, #1273)

## Additional changes interesting for devels
- drop unused `packager` field from gpg-signatures.json (#1233)
- [IPU 9 -> 10] make system_upgrade/common leapp repo Python 3.12 compatible
- [IPU 9 -> 10] introduced system_upgrade/el9toel10 leapp repo
yuravk pushed a commit to yuravk/leapp-repository that referenced this pull request Aug 20, 2024
@pirat89 @yuravk
# Release 0.21.0 (oamg#1282)
3eb4ade 
## Packaging
- Start building for EL 9 in the upstream repository on COPR (oamg#1169)

## Upgrade handling
### Fixes
- Add missing RHUI GCP config info for RHEL for SAP (oamg#1253)
- Fix creation of the post upgrade report about changes in states of systemd services (oamg#1210)
- Fix detection of valid sshd config with internal-sftp subsystem in Leapp (oamg#1212)
- Fix evaluation of PES data (oamg#1194)
- Fix failing "update-ca-trust" command caused by missing util-linux package (oamg#1169)
- Fix handling of versions in RHUI configuration for ELS and SAP upgrades (oamg#1240)
- Fix the parsing of the lscpu output (oamg#1184, oamg#1208)
- Fix the upgrade of systems using RHUI on AWS after changes in RHUI client package (oamg#1178)
- Fix upgrade on aarch64 via RHUI on AWS (oamg#1240)
- Handle a false positive GPG check error when TargetUserSpaceInfo is missing  (oamg#1269)
- Target by default always "GA" channel repositories unless a different channel is specified for the leapp execution (oamg#1205)
- Update the default kernel cmdline (oamg#1193, oamg#1216)
- Update the device driver deprecation data, fixing invalid fields for some AMD CPUs (oamg#1211)
- Wait for the storage initialization when /usr is on separate file system - covering SAN (oamg#1218, oamg#1219)
- [IPU 7 -> 8] Drop enforced tomcat removal for satellite when upgrading to RHEL 8.10 (oamg#1243)
- [IPU 7 -> 8] Fix detection of bootable device on RAID (oamg#1260)
- [IPU 8 -> 9] Inhibit the upgrade to RHEL 9.5 on ARM architecture due to incompatibility of the RHEL 8 bootloader and RHEL 9.5 kernel (oamg#1270)

### Enhancements
- [IPU 8 -> 9] Introduce upgrade path 8.10 -> 9.5 (oamg#1245, oamg#1246)
- Update leapp data files (oamg#1280)
- Apply solutions for leftover rpms for all major upgrade paths - including experimental actors (oamg#1199)
- Do not terminate the upgrade dracut module execution anymore if /sysroot/root/tmp_leapp_py3/.leapp_upgrade_failed exists (oamg#1197)
- Improve set_systemd_services_states logging (oamg#1213)
- Include leapp command execution and defined leapp envars inside leapp.db - (oamg#1152)
- Introduce experimental upgrades in 'live' mode for the testing (oamg#1248)
- Load obsoleted GPG keys from gpg-signatures.json file instead of hardcoding them (oamg#1241)
- Several minor improvements in messages printed in console output (oamg#1173, oamg#1214, oamg#1274)
- Several minor improvements in report and error messages (oamg#1207, oamg#1217, oamg#1234, oamg#1235, oamg#1242)
- Sort lists in dnf-plugin-data for easier overview (oamg#1231)
- [IPU 7 -> 8] Allow upgrade of content from ELS repositories (oamg#1198)
- [IPU 7 -> 8] Inhibit the upgrade when Legacy GRUB is detected (oamg#1206)
- [IPU 7 -> 8] Inhibit the upgrade when embedding area is small to prevent failed bootloader update (oamg#1195)
- [IPU 8 -> 9] Enable EL 8 > 9 upgrades on Alibaba cloud (oamg#1249)
- [IPU 8 -> 9] Enable EL 8 to 9 upgrade of Satellite/Foreman server (oamg#1181)
- [IPU 9 -> 10] Introduced number of changes to enable IPU 9 -> 10 for testing (oamg#1169)
- [IPU 9 -> 10] Prevent upgrading if NetworkManager is configured with dhcp=dhclient (oamg#1268)
- [IPU 9 -> 10] Update URLs in reports to reflect the next planned major upgrade path (oamg#1169, oamg#1273)

## Additional changes interesting for devels
- drop unused `packager` field from gpg-signatures.json (oamg#1233)
- [IPU 9 -> 10] make system_upgrade/common leapp repo Python 3.12 compatible
- [IPU 9 -> 10] introduced system_upgrade/el9toel10 leapp repo

(cherry picked from commit 03c257b)
yuravk pushed a commit to yuravk/leapp-repository that referenced this pull request Aug 20, 2024
@pirat89 @yuravk
# Release 0.21.0 (oamg#1282)
3ef49b8 
## Packaging
- Start building for EL 9 in the upstream repository on COPR (oamg#1169)

## Upgrade handling
### Fixes
- Add missing RHUI GCP config info for RHEL for SAP (oamg#1253)
- Fix creation of the post upgrade report about changes in states of systemd services (oamg#1210)
- Fix detection of valid sshd config with internal-sftp subsystem in Leapp (oamg#1212)
- Fix evaluation of PES data (oamg#1194)
- Fix failing "update-ca-trust" command caused by missing util-linux package (oamg#1169)
- Fix handling of versions in RHUI configuration for ELS and SAP upgrades (oamg#1240)
- Fix the parsing of the lscpu output (oamg#1184, oamg#1208)
- Fix the upgrade of systems using RHUI on AWS after changes in RHUI client package (oamg#1178)
- Fix upgrade on aarch64 via RHUI on AWS (oamg#1240)
- Handle a false positive GPG check error when TargetUserSpaceInfo is missing  (oamg#1269)
- Target by default always "GA" channel repositories unless a different channel is specified for the leapp execution (oamg#1205)
- Update the default kernel cmdline (oamg#1193, oamg#1216)
- Update the device driver deprecation data, fixing invalid fields for some AMD CPUs (oamg#1211)
- Wait for the storage initialization when /usr is on separate file system - covering SAN (oamg#1218, oamg#1219)
- [IPU 7 -> 8] Drop enforced tomcat removal for satellite when upgrading to RHEL 8.10 (oamg#1243)
- [IPU 7 -> 8] Fix detection of bootable device on RAID (oamg#1260)
- [IPU 8 -> 9] Inhibit the upgrade to RHEL 9.5 on ARM architecture due to incompatibility of the RHEL 8 bootloader and RHEL 9.5 kernel (oamg#1270)

### Enhancements
- [IPU 8 -> 9] Introduce upgrade path 8.10 -> 9.5 (oamg#1245, oamg#1246)
- Update leapp data files (oamg#1280)
- Apply solutions for leftover rpms for all major upgrade paths - including experimental actors (oamg#1199)
- Do not terminate the upgrade dracut module execution anymore if /sysroot/root/tmp_leapp_py3/.leapp_upgrade_failed exists (oamg#1197)
- Improve set_systemd_services_states logging (oamg#1213)
- Include leapp command execution and defined leapp envars inside leapp.db - (oamg#1152)
- Introduce experimental upgrades in 'live' mode for the testing (oamg#1248)
- Load obsoleted GPG keys from gpg-signatures.json file instead of hardcoding them (oamg#1241)
- Several minor improvements in messages printed in console output (oamg#1173, oamg#1214, oamg#1274)
- Several minor improvements in report and error messages (oamg#1207, oamg#1217, oamg#1234, oamg#1235, oamg#1242)
- Sort lists in dnf-plugin-data for easier overview (oamg#1231)
- [IPU 7 -> 8] Allow upgrade of content from ELS repositories (oamg#1198)
- [IPU 7 -> 8] Inhibit the upgrade when Legacy GRUB is detected (oamg#1206)
- [IPU 7 -> 8] Inhibit the upgrade when embedding area is small to prevent failed bootloader update (oamg#1195)
- [IPU 8 -> 9] Enable EL 8 > 9 upgrades on Alibaba cloud (oamg#1249)
- [IPU 8 -> 9] Enable EL 8 to 9 upgrade of Satellite/Foreman server (oamg#1181)
- [IPU 9 -> 10] Introduced number of changes to enable IPU 9 -> 10 for testing (oamg#1169)
- [IPU 9 -> 10] Prevent upgrading if NetworkManager is configured with dhcp=dhclient (oamg#1268)
- [IPU 9 -> 10] Update URLs in reports to reflect the next planned major upgrade path (oamg#1169, oamg#1273)

## Additional changes interesting for devels
- drop unused `packager` field from gpg-signatures.json (oamg#1233)
- [IPU 9 -> 10] make system_upgrade/common leapp repo Python 3.12 compatible
- [IPU 9 -> 10] introduced system_upgrade/el9toel10 leapp repo

(cherry picked from commit 03c257b)
@yuravk yuravk mentioned this pull request Aug 22, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@MichalHe MichalHe MichalHe requested changes

@Rezney Rezney Rezney approved these changes

Assignees
No one assigned
Labels
changelog-checked The merger/reviewer checked the changelog draft document and updated it when relevant
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@Jakuje @pirat89 @MichalHe @Rezney