From c8dc0b229b3cbcb72ca90ddf025087586a7d2e38 Mon Sep 17 00:00:00 2001 From: Pino Toscano Date: Thu, 7 May 2020 14:02:30 +0200 Subject: [PATCH] sysprep: add Kerberos keytab file removal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This new operation removes the Kerberos /etc/krb5.keytab file from the guest. Thanks to Christian Heimes and François Cami for the hints. Related to RHBZ#1789592. (cherry picked from commit faa5d8507f552e05435312f16d9e50f613a13615) --- sysprep/Makefile.am | 1 + .../sysprep_operation_kerberos_hostkeytab.ml | 38 +++++++++++++++++++ 2 files changed, 39 insertions(+) create mode 100644 sysprep/sysprep_operation_kerberos_hostkeytab.ml diff --git a/sysprep/Makefile.am b/sysprep/Makefile.am index 79266314b..a99957306 100644 --- a/sysprep/Makefile.am +++ b/sysprep/Makefile.am @@ -45,6 +45,7 @@ operations = \ fs_uuids \ ipa_client \ kerberos_data \ + kerberos_hostkeytab \ lvm_uuids \ logfiles \ machine_id \ diff --git a/sysprep/sysprep_operation_kerberos_hostkeytab.ml b/sysprep/sysprep_operation_kerberos_hostkeytab.ml new file mode 100644 index 000000000..cb3023353 --- /dev/null +++ b/sysprep/sysprep_operation_kerberos_hostkeytab.ml @@ -0,0 +1,38 @@ +(* virt-sysprep + * Copyright (C) 2020 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + *) + +open Sysprep_operation +open Common_gettext.Gettext + +module G = Guestfs + +let kerberos_hostkeytab_perform (g : Guestfs.guestfs) root side_effects = + let typ = g#inspect_get_type root in + if typ <> "windows" then ( + (try g#rm "/etc/krb5.keytab" with G.Error _ -> ()) + ) + +let op = { + defaults with + name = "kerberos-hostkeytab"; + enabled_by_default = true; + heading = s_"Remove the Kerberos host keytab file in the guest"; + perform_on_filesystems = Some kerberos_hostkeytab_perform; +} + +let () = register_operation op -- 2.18.4