60b89f
From b590dcef10680b4ea3181ae1caec183e5967562b Mon Sep 17 00:00:00 2001
60b89f
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
60b89f
Date: Fri, 11 Dec 2020 07:35:59 +0200
60b89f
Subject: [PATCH] ipatests: add TestInstallWithoutSudo
60b89f
MIME-Version: 1.0
60b89f
Content-Type: text/plain; charset=UTF-8
60b89f
Content-Transfer-Encoding: 8bit
60b89f
60b89f
Test IPA servers and clients behavior when sudo is not installed.
60b89f
60b89f
Fixes: https://pagure.io/freeipa/issue/8530
60b89f
Signed-off-by: François Cami <fcami@redhat.com>
60b89f
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
60b89f
Reviewed-By: Armando Neto <abiagion@redhat.com>
60b89f
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
60b89f
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
60b89f
Reviewed-By: Armando Neto <abiagion@redhat.com>
60b89f
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
60b89f
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
60b89f
---
60b89f
 .../nightly_ipa-4-9_latest.yaml               | 12 ++++
60b89f
 .../nightly_ipa-4-9_latest_selinux.yaml       | 13 ++++
60b89f
 .../nightly_ipa-4-9_previous.yaml             | 12 ++++
60b89f
 .../test_integration/test_installation.py     | 66 +++++++++++++++++++
60b89f
 4 files changed, 103 insertions(+)
60b89f
60b89f
diff --git a/ipatests/prci_definitions/nightly_ipa-4-9_latest.yaml b/ipatests/prci_definitions/nightly_ipa-4-9_latest.yaml
60b89f
index 3acd6a13c..d91b16cab 100644
60b89f
--- a/ipatests/prci_definitions/nightly_ipa-4-9_latest.yaml
60b89f
+++ b/ipatests/prci_definitions/nightly_ipa-4-9_latest.yaml
60b89f
@@ -535,6 +535,18 @@ jobs:
60b89f
         timeout: 10800
60b89f
         topology: *master_1repl
60b89f
 
60b89f
+  fedora-latest-ipa-4-9/test_installation_TestInstallWithoutSudo:
60b89f
+    requires: [fedora-latest-ipa-4-9/build]
60b89f
+    priority: 50
60b89f
+    job:
60b89f
+      class: RunPytest
60b89f
+      args:
60b89f
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
60b89f
+        test_suite: test_integration/test_installation.py::TestInstallWithoutSudo
60b89f
+        template: *ci-ipa-4-9-latest
60b89f
+        timeout: 4800
60b89f
+        topology: *master_1repl_1client
60b89f
+
60b89f
   fedora-latest-ipa-4-9/test_idviews:
60b89f
     requires: [fedora-latest-ipa-4-9/build]
60b89f
     priority: 50
60b89f
diff --git a/ipatests/prci_definitions/nightly_ipa-4-9_latest_selinux.yaml b/ipatests/prci_definitions/nightly_ipa-4-9_latest_selinux.yaml
60b89f
index c01192cf5..8adb06d0c 100644
60b89f
--- a/ipatests/prci_definitions/nightly_ipa-4-9_latest_selinux.yaml
60b89f
+++ b/ipatests/prci_definitions/nightly_ipa-4-9_latest_selinux.yaml
60b89f
@@ -575,6 +575,19 @@ jobs:
60b89f
         timeout: 10800
60b89f
         topology: *master_1repl
60b89f
 
60b89f
+  fedora-latest-ipa-4-9/test_installation_TestInstallWithoutSudo:
60b89f
+    requires: [fedora-latest-ipa-4-9/build]
60b89f
+    priority: 50
60b89f
+    job:
60b89f
+      class: RunPytest
60b89f
+      args:
60b89f
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
60b89f
+        selinux_enforcing: True
60b89f
+        test_suite: test_integration/test_installation.py::TestInstallWithoutSudo
60b89f
+        template: *ci-ipa-4-9-latest
60b89f
+        timeout: 4800
60b89f
+        topology: *master_1repl_1client
60b89f
+
60b89f
   fedora-latest-ipa-4-9/test_idviews:
60b89f
     requires: [fedora-latest-ipa-4-9/build]
60b89f
     priority: 50
60b89f
diff --git a/ipatests/prci_definitions/nightly_ipa-4-9_previous.yaml b/ipatests/prci_definitions/nightly_ipa-4-9_previous.yaml
60b89f
index a6ea24f6a..2b5d4fd5e 100644
60b89f
--- a/ipatests/prci_definitions/nightly_ipa-4-9_previous.yaml
60b89f
+++ b/ipatests/prci_definitions/nightly_ipa-4-9_previous.yaml
60b89f
@@ -535,6 +535,18 @@ jobs:
60b89f
         timeout: 10800
60b89f
         topology: *master_1repl
60b89f
 
60b89f
+  fedora-previous-ipa-4-9/test_installation_TestInstallWithoutSudo:
60b89f
+    requires: [fedora-previous-ipa-4-9/build]
60b89f
+    priority: 50
60b89f
+    job:
60b89f
+      class: RunPytest
60b89f
+      args:
60b89f
+        build_url: '{fedora-previous-ipa-4-9/build_url}'
60b89f
+        test_suite: test_integration/test_installation.py::TestInstallWithoutSudo
60b89f
+        template: *ci-ipa-4-9-previous
60b89f
+        timeout: 4800
60b89f
+        topology: *master_1repl_1client
60b89f
+
60b89f
   fedora-previous-ipa-4-9/test_idviews:
60b89f
     requires: [fedora-previous-ipa-4-9/build]
60b89f
     priority: 50
60b89f
diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py
60b89f
index eb6f7d78e..6e8af024c 100644
60b89f
--- a/ipatests/test_integration/test_installation.py
60b89f
+++ b/ipatests/test_integration/test_installation.py
60b89f
@@ -1537,3 +1537,69 @@ class TestInstallReplicaAgainstSpecificServer(IntegrationTest):
60b89f
                                             self.replicas[0].hostname],
60b89f
                                            stdin_text=dirman_password)
60b89f
         assert self.replicas[0].hostname not in cmd.stdout_text
60b89f
+
60b89f
+
60b89f
+class TestInstallWithoutSudo(IntegrationTest):
60b89f
+
60b89f
+    num_clients = 1
60b89f
+    num_replicas = 1
60b89f
+    no_sudo_str = "The sudo binary does not seem to be present on this"
60b89f
+
60b89f
+    @classmethod
60b89f
+    def install(cls, mh):
60b89f
+        pass
60b89f
+
60b89f
+    def test_sudo_removal(self):
60b89f
+        # ipa-client makes sudo depend on libsss_sudo.
60b89f
+
60b89f
+        # --nodeps is mandatory because dogtag uses sudo at install
60b89f
+        # time until commit 49585867207922479644a03078c29548de02cd03
60b89f
+        # which is scheduled to land in 10.10.
60b89f
+
60b89f
+        # This also means sudo+libsss_sudo cannot be uninstalled on
60b89f
+        # IPA servers with a CA.
60b89f
+        assert tasks.is_package_installed(self.clients[0], 'sudo')
60b89f
+        assert tasks.is_package_installed(self.clients[0], 'libsss_sudo')
60b89f
+        tasks.uninstall_packages(
60b89f
+            self.clients[0], ['sudo', 'libsss_sudo'], nodeps=True
60b89f
+        )
60b89f
+
60b89f
+    def test_ipa_installation_without_sudo(self):
60b89f
+        # FixMe: When Dogtag 10.10 is out, test installation without sudo
60b89f
+        tasks.install_master(self.master, setup_dns=True)
60b89f
+
60b89f
+    def test_replica_installation_without_sudo(self):
60b89f
+        # FixMe: When Dogtag 10.10 is out, test replica installation
60b89f
+        # without sudo and with CA
60b89f
+        tasks.uninstall_packages(
60b89f
+            self.replicas[0], ['sudo', 'libsss_sudo'], nodeps=True
60b89f
+        )
60b89f
+        # One-step install is needed.
60b89f
+        # With promote=True, two-step install is done and that only captures
60b89f
+        # the ipa-replica-install stdout/stderr, not ipa-client-install's.
60b89f
+        result = tasks.install_replica(
60b89f
+            self.master, self.replicas[0], promote=False,
60b89f
+            setup_dns=True, setup_ca=False
60b89f
+        )
60b89f
+        assert self.no_sudo_str in result.stderr_text
60b89f
+
60b89f
+    def test_client_installation_without_sudo(self):
60b89f
+        result = tasks.install_client(self.master, self.clients[0])
60b89f
+        assert self.no_sudo_str in result.stderr_text
60b89f
+
60b89f
+    def test_remove_sudo_on_ipa(self):
60b89f
+        tasks.uninstall_packages(
60b89f
+            self.master, ['sudo', 'libsss_sudo'], nodeps=True
60b89f
+        )
60b89f
+        self.master.run_command(
60b89f
+            ['ipactl', 'restart']
60b89f
+        )
60b89f
+
60b89f
+    def test_install_sudo_on_client(self):
60b89f
+        """ Check that installing sudo pulls libsss_sudo in"""
60b89f
+        for pkg in ('sudo', 'libsss_sudo'):
60b89f
+            assert tasks.is_package_installed(self.clients[0], pkg) is False
60b89f
+        tasks.uninstall_client(self.clients[0])
60b89f
+        tasks.install_packages(self.clients[0], ['sudo'])
60b89f
+        for pkg in ('sudo', 'libsss_sudo'):
60b89f
+            assert tasks.is_package_installed(self.clients[0], pkg)
60b89f
-- 
60b89f
2.29.2
60b89f
60b89f
From 0c2741af9f353d2fbb21a5768e6433c0e99da0e9 Mon Sep 17 00:00:00 2001
60b89f
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
60b89f
Date: Thu, 10 Dec 2020 08:35:12 +0200
60b89f
Subject: [PATCH] ipatests: tasks: handle uninstalling packages with nodeps
60b89f
MIME-Version: 1.0
60b89f
Content-Type: text/plain; charset=UTF-8
60b89f
Content-Transfer-Encoding: 8bit
60b89f
60b89f
Handle package removal without taking dependencies into account.
60b89f
E.g. add frontends for rpm -e --nodeps.
60b89f
60b89f
Related: ipatests/pytest_ipa/integration/tasks.py
60b89f
Signed-off-by: François Cami <fcami@redhat.com>
60b89f
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
60b89f
Reviewed-By: Armando Neto <abiagion@redhat.com>
60b89f
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
60b89f
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
60b89f
Reviewed-By: Armando Neto <abiagion@redhat.com>
60b89f
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
60b89f
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
60b89f
---
60b89f
 ipatests/pytest_ipa/integration/tasks.py | 51 +++++++++++++++++++-----
60b89f
 1 file changed, 41 insertions(+), 10 deletions(-)
60b89f
60b89f
diff --git a/ipatests/pytest_ipa/integration/tasks.py b/ipatests/pytest_ipa/integration/tasks.py
60b89f
index b91859816..2fe78367f 100755
60b89f
--- a/ipatests/pytest_ipa/integration/tasks.py
60b89f
+++ b/ipatests/pytest_ipa/integration/tasks.py
60b89f
@@ -29,6 +29,7 @@ import re
60b89f
 import collections
60b89f
 import itertools
60b89f
 import shutil
60b89f
+import shlex
60b89f
 import copy
60b89f
 import subprocess
60b89f
 import tempfile
60b89f
@@ -2381,20 +2382,33 @@ def download_packages(host, pkgs):
60b89f
     return tmpdir
60b89f
 
60b89f
 
60b89f
-def uninstall_packages(host, pkgs):
60b89f
+def uninstall_packages(host, pkgs, nodeps=False):
60b89f
     """Uninstall packages on a remote host.
60b89f
-    :param host: the host where the uninstallation takes place
60b89f
-    :param pkgs: packages to uninstall, provided as a list of strings
60b89f
+    :param host: the host where the uninstallation takes place.
60b89f
+    :param pkgs: packages to uninstall, provided as a list of strings.
60b89f
+    :param nodeps: ignore dependencies (dangerous!).
60b89f
     """
60b89f
     platform = get_platform(host)
60b89f
-    # Only supports RHEL 8+ and Fedora for now
60b89f
-    if platform in ('rhel', 'fedora'):
60b89f
-        install_cmd = ['/usr/bin/dnf', 'remove', '-y']
60b89f
-    elif platform in ('ubuntu'):
60b89f
-        install_cmd = ['apt-get', 'remove', '-y']
60b89f
+    if platform not in ('rhel', 'fedora', 'ubuntu'):
60b89f
+        raise ValueError('uninstall_packages: unknown platform %s' % platform)
60b89f
+    if nodeps:
60b89f
+        if platform in ('rhel', 'fedora'):
60b89f
+            cmd = "rpm -e --nodeps"
60b89f
+        elif platform in ('ubuntu'):
60b89f
+            cmd = "dpkg -P --force-depends"
60b89f
+        for package in pkgs:
60b89f
+            uninstall_cmd = shlex.split(cmd)
60b89f
+            uninstall_cmd.append(package)
60b89f
+            # keep raiseonerr=True here. --fcami
60b89f
+            host.run_command(uninstall_cmd)
60b89f
     else:
60b89f
-        raise ValueError('install_packages: unknown platform %s' % platform)
60b89f
-    host.run_command(install_cmd + pkgs, raiseonerr=False)
60b89f
+        if platform in ('rhel', 'fedora'):
60b89f
+            cmd = "/usr/bin/dnf remove -y"
60b89f
+        elif platform in ('ubuntu'):
60b89f
+            cmd = "apt-get remove -y"
60b89f
+        uninstall_cmd = shlex.split(cmd)
60b89f
+        uninstall_cmd.extend(pkgs)
60b89f
+        host.run_command(uninstall_cmd, raiseonerr=False)
60b89f
 
60b89f
 
60b89f
 def wait_for_request(host, request_id, timeout=120):
60b89f
@@ -2649,3 +2663,20 @@ def run_ssh_cmd(
60b89f
             assert "Authentication succeeded" not in stderr
60b89f
             assert "No more authentication methods to try." in stderr
60b89f
     return (return_code, stdout, stderr)
60b89f
+
60b89f
+
60b89f
+def is_package_installed(host, pkg):
60b89f
+    platform = get_platform(host)
60b89f
+    if platform in ('rhel', 'fedora'):
60b89f
+        result = host.run_command(
60b89f
+            ['rpm', '-q', pkg], raiseonerr=False
60b89f
+        )
60b89f
+    elif platform in ['ubuntu']:
60b89f
+        result = host.run_command(
60b89f
+            ['dpkg', '-s', pkg], raiseonerr=False
60b89f
+        )
60b89f
+    else:
60b89f
+        raise ValueError(
60b89f
+            'is_package_installed: unknown platform %s' % platform
60b89f
+        )
60b89f
+    return result.returncode == 0
60b89f
-- 
60b89f
2.29.2
60b89f
60b89f
From fe157ca349e3146a53884e90e6e588efb4e97eeb Mon Sep 17 00:00:00 2001
60b89f
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
60b89f
Date: Thu, 10 Dec 2020 08:15:22 +0200
60b89f
Subject: [PATCH] ipa-client-install: output a warning if sudo is not present
60b89f
MIME-Version: 1.0
60b89f
Content-Type: text/plain; charset=UTF-8
60b89f
Content-Transfer-Encoding: 8bit
60b89f
60b89f
Fixes: https://pagure.io/freeipa/issue/8530
60b89f
Signed-off-by: François Cami <fcami@redhat.com>
60b89f
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
60b89f
Reviewed-By: Armando Neto <abiagion@redhat.com>
60b89f
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
60b89f
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
60b89f
Reviewed-By: Armando Neto <abiagion@redhat.com>
60b89f
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
60b89f
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
60b89f
---
60b89f
 ipaclient/install/client.py | 14 +++++++++++++-
60b89f
 1 file changed, 13 insertions(+), 1 deletion(-)
60b89f
60b89f
diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py
60b89f
index 8acfa0cd1..0e478fa26 100644
60b89f
--- a/ipaclient/install/client.py
60b89f
+++ b/ipaclient/install/client.py
60b89f
@@ -24,6 +24,7 @@ import re
60b89f
 import SSSDConfig
60b89f
 import shutil
60b89f
 import socket
60b89f
+import subprocess
60b89f
 import sys
60b89f
 import tempfile
60b89f
 import textwrap
60b89f
@@ -2200,7 +2201,18 @@ def install_check(options):
60b89f
             "authentication resources",
60b89f
             rval=CLIENT_INSTALL_ERROR)
60b89f
 
60b89f
-    # when installing with '--no-sssd' option, check whether nss-ldap is
60b89f
+    # When installing without the "--no-sudo" option, check whether sudo is
60b89f
+    # available.
60b89f
+    if options.conf_sudo:
60b89f
+        try:
60b89f
+            subprocess.Popen(['sudo -V'])
60b89f
+        except FileNotFoundError:
60b89f
+            logger.info(
60b89f
+                "The sudo binary does not seem to be present on this "
60b89f
+                "system. Please consider installing sudo if required."
60b89f
+            )
60b89f
+
60b89f
+    # when installing with the '--no-sssd' option, check whether nss-ldap is
60b89f
     # installed
60b89f
     if not options.sssd:
60b89f
         if not os.path.exists(paths.PAM_KRB5_SO):
60b89f
-- 
60b89f
2.29.2
60b89f
60b89f
From ee0ba2df41cf545b82d3d26e7e7e42447bb0f63e Mon Sep 17 00:00:00 2001
60b89f
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
60b89f
Date: Thu, 10 Dec 2020 07:55:16 +0200
60b89f
Subject: [PATCH] freeipa.spec: client: depend on libsss_sudo and sudo
60b89f
MIME-Version: 1.0
60b89f
Content-Type: text/plain; charset=UTF-8
60b89f
Content-Transfer-Encoding: 8bit
60b89f
60b89f
On 10.10+ releases of Dogtag, the PKI installer will not depend
60b89f
on sudo anymore. This opens the possibility of creating IPA servers
60b89f
without a properly configured sudo.
60b89f
In fact, even IPA clients should have sudo and libsss_sudo installed
60b89f
in most cases, so add a weak dependency on both of them to the client
60b89f
subpackage.
60b89f
Also make sure libsss_sudo is installed if sudo is present.
60b89f
60b89f
Fixes: https://pagure.io/freeipa/issue/8530
60b89f
Signed-off-by: François Cami <fcami@redhat.com>
60b89f
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
60b89f
Reviewed-By: Armando Neto <abiagion@redhat.com>
60b89f
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
60b89f
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
60b89f
Reviewed-By: Armando Neto <abiagion@redhat.com>
60b89f
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
60b89f
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
60b89f
---
60b89f
 freeipa.spec.in | 5 +++++
60b89f
 1 file changed, 5 insertions(+)
60b89f
60b89f
diff --git a/freeipa.spec.in b/freeipa.spec.in
60b89f
index ba52a3834..93e473ac4 100755
60b89f
--- a/freeipa.spec.in
60b89f
+++ b/freeipa.spec.in
60b89f
@@ -640,6 +640,11 @@ Requires: nfs-utils
60b89f
 Requires: sssd-tools >= %{sssd_version}
60b89f
 Requires(post): policycoreutils
60b89f
 
60b89f
+# https://pagure.io/freeipa/issue/8530
60b89f
+Recommends: libsss_sudo
60b89f
+Recommends: sudo
60b89f
+Requires: (libsss_sudo if sudo)
60b89f
+
60b89f
 Provides: %{alt_name}-client = %{version}
60b89f
 Conflicts: %{alt_name}-client
60b89f
 Obsoletes: %{alt_name}-client < %{version}
60b89f
-- 
60b89f
2.29.2
60b89f