From b590dcef10680b4ea3181ae1caec183e5967562b Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>

Date: Fri, 11 Dec 2020 07:35:59 +0200

Subject: [PATCH] ipatests: add TestInstallWithoutSudo

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Test IPA servers and clients behavior when sudo is not installed.

Fixes: https://pagure.io/freeipa/issue/8530

Signed-off-by: François Cami <fcami@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: Armando Neto <abiagion@redhat.com>

Reviewed-By: Michal Polovka <mpolovka@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: Armando Neto <abiagion@redhat.com>

Reviewed-By: Michal Polovka <mpolovka@redhat.com>

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

---

 .../nightly_ipa-4-9_latest.yaml               | 12 ++++

 .../nightly_ipa-4-9_latest_selinux.yaml       | 13 ++++

 .../nightly_ipa-4-9_previous.yaml             | 12 ++++

 .../test_integration/test_installation.py     | 66 +++++++++++++++++++

 4 files changed, 103 insertions(+)

diff --git a/ipatests/prci_definitions/nightly_ipa-4-9_latest.yaml b/ipatests/prci_definitions/nightly_ipa-4-9_latest.yaml

index 3acd6a13c..d91b16cab 100644

--- a/ipatests/prci_definitions/nightly_ipa-4-9_latest.yaml

+++ b/ipatests/prci_definitions/nightly_ipa-4-9_latest.yaml

@@ -535,6 +535,18 @@ jobs:

         timeout: 10800

         topology: *master_1repl

+  fedora-latest-ipa-4-9/test_installation_TestInstallWithoutSudo:

+    requires: [fedora-latest-ipa-4-9/build]

+    priority: 50

+    job:

+      class: RunPytest

+      args:

+        build_url: '{fedora-latest-ipa-4-9/build_url}'

+        test_suite: test_integration/test_installation.py::TestInstallWithoutSudo

+        template: *ci-ipa-4-9-latest

+        timeout: 4800

+        topology: *master_1repl_1client

+

   fedora-latest-ipa-4-9/test_idviews:

     requires: [fedora-latest-ipa-4-9/build]

     priority: 50

diff --git a/ipatests/prci_definitions/nightly_ipa-4-9_latest_selinux.yaml b/ipatests/prci_definitions/nightly_ipa-4-9_latest_selinux.yaml

index c01192cf5..8adb06d0c 100644

--- a/ipatests/prci_definitions/nightly_ipa-4-9_latest_selinux.yaml

+++ b/ipatests/prci_definitions/nightly_ipa-4-9_latest_selinux.yaml

@@ -575,6 +575,19 @@ jobs:

         timeout: 10800

         topology: *master_1repl

+  fedora-latest-ipa-4-9/test_installation_TestInstallWithoutSudo:

+    requires: [fedora-latest-ipa-4-9/build]

+    priority: 50

+    job:

+      class: RunPytest

+      args:

+        build_url: '{fedora-latest-ipa-4-9/build_url}'

+        selinux_enforcing: True

+        test_suite: test_integration/test_installation.py::TestInstallWithoutSudo

+        template: *ci-ipa-4-9-latest

+        timeout: 4800

+        topology: *master_1repl_1client

+

   fedora-latest-ipa-4-9/test_idviews:

     requires: [fedora-latest-ipa-4-9/build]

     priority: 50

diff --git a/ipatests/prci_definitions/nightly_ipa-4-9_previous.yaml b/ipatests/prci_definitions/nightly_ipa-4-9_previous.yaml

index a6ea24f6a..2b5d4fd5e 100644

--- a/ipatests/prci_definitions/nightly_ipa-4-9_previous.yaml

+++ b/ipatests/prci_definitions/nightly_ipa-4-9_previous.yaml

@@ -535,6 +535,18 @@ jobs:

         timeout: 10800

         topology: *master_1repl

+  fedora-previous-ipa-4-9/test_installation_TestInstallWithoutSudo:

+    requires: [fedora-previous-ipa-4-9/build]

+    priority: 50

+    job:

+      class: RunPytest

+      args:

+        build_url: '{fedora-previous-ipa-4-9/build_url}'

+        test_suite: test_integration/test_installation.py::TestInstallWithoutSudo

+        template: *ci-ipa-4-9-previous

+        timeout: 4800

+        topology: *master_1repl_1client

+

   fedora-previous-ipa-4-9/test_idviews:

     requires: [fedora-previous-ipa-4-9/build]

     priority: 50

diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py

index eb6f7d78e..6e8af024c 100644

--- a/ipatests/test_integration/test_installation.py

+++ b/ipatests/test_integration/test_installation.py

@@ -1537,3 +1537,69 @@ class TestInstallReplicaAgainstSpecificServer(IntegrationTest):

                                             self.replicas[0].hostname],

                                            stdin_text=dirman_password)

         assert self.replicas[0].hostname not in cmd.stdout_text

+

+

+class TestInstallWithoutSudo(IntegrationTest):

+

+    num_clients = 1

+    num_replicas = 1

+    no_sudo_str = "The sudo binary does not seem to be present on this"

+

+    @classmethod

+    def install(cls, mh):

+        pass

+

+    def test_sudo_removal(self):

+        # ipa-client makes sudo depend on libsss_sudo.

+

+        # --nodeps is mandatory because dogtag uses sudo at install

+        # time until commit 49585867207922479644a03078c29548de02cd03

+        # which is scheduled to land in 10.10.

+

+        # This also means sudo+libsss_sudo cannot be uninstalled on

+        # IPA servers with a CA.

+        assert tasks.is_package_installed(self.clients[0], 'sudo')

+        assert tasks.is_package_installed(self.clients[0], 'libsss_sudo')

+        tasks.uninstall_packages(

+            self.clients[0], ['sudo', 'libsss_sudo'], nodeps=True

+        )

+

+    def test_ipa_installation_without_sudo(self):

+        # FixMe: When Dogtag 10.10 is out, test installation without sudo

+        tasks.install_master(self.master, setup_dns=True)

+

+    def test_replica_installation_without_sudo(self):

+        # FixMe: When Dogtag 10.10 is out, test replica installation

+        # without sudo and with CA

+        tasks.uninstall_packages(

+            self.replicas[0], ['sudo', 'libsss_sudo'], nodeps=True

+        )

+        # One-step install is needed.

+        # With promote=True, two-step install is done and that only captures

+        # the ipa-replica-install stdout/stderr, not ipa-client-install's.

+        result = tasks.install_replica(

+            self.master, self.replicas[0], promote=False,

+            setup_dns=True, setup_ca=False

+        )

+        assert self.no_sudo_str in result.stderr_text

+

+    def test_client_installation_without_sudo(self):

+        result = tasks.install_client(self.master, self.clients[0])

+        assert self.no_sudo_str in result.stderr_text

+

+    def test_remove_sudo_on_ipa(self):

+        tasks.uninstall_packages(

+            self.master, ['sudo', 'libsss_sudo'], nodeps=True

+        )

+        self.master.run_command(

+            ['ipactl', 'restart']

+        )

+

+    def test_install_sudo_on_client(self):

+        """ Check that installing sudo pulls libsss_sudo in"""

+        for pkg in ('sudo', 'libsss_sudo'):

+            assert tasks.is_package_installed(self.clients[0], pkg) is False

+        tasks.uninstall_client(self.clients[0])

+        tasks.install_packages(self.clients[0], ['sudo'])

+        for pkg in ('sudo', 'libsss_sudo'):

+            assert tasks.is_package_installed(self.clients[0], pkg)

-- 

2.29.2

From 0c2741af9f353d2fbb21a5768e6433c0e99da0e9 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>

Date: Thu, 10 Dec 2020 08:35:12 +0200

Subject: [PATCH] ipatests: tasks: handle uninstalling packages with nodeps

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Handle package removal without taking dependencies into account.

E.g. add frontends for rpm -e --nodeps.

Related: ipatests/pytest_ipa/integration/tasks.py

Signed-off-by: François Cami <fcami@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: Armando Neto <abiagion@redhat.com>

Reviewed-By: Michal Polovka <mpolovka@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: Armando Neto <abiagion@redhat.com>

Reviewed-By: Michal Polovka <mpolovka@redhat.com>

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

---

 ipatests/pytest_ipa/integration/tasks.py | 51 +++++++++++++++++++-----

 1 file changed, 41 insertions(+), 10 deletions(-)

diff --git a/ipatests/pytest_ipa/integration/tasks.py b/ipatests/pytest_ipa/integration/tasks.py

index b91859816..2fe78367f 100755

--- a/ipatests/pytest_ipa/integration/tasks.py

+++ b/ipatests/pytest_ipa/integration/tasks.py

@@ -29,6 +29,7 @@ import re

 import collections

 import itertools

 import shutil

+import shlex

 import copy

 import subprocess

 import tempfile

@@ -2381,20 +2382,33 @@ def download_packages(host, pkgs):

     return tmpdir

-def uninstall_packages(host, pkgs):

+def uninstall_packages(host, pkgs, nodeps=False):

     """Uninstall packages on a remote host.

-    :param host: the host where the uninstallation takes place

-    :param pkgs: packages to uninstall, provided as a list of strings

+    :param host: the host where the uninstallation takes place.

+    :param pkgs: packages to uninstall, provided as a list of strings.

+    :param nodeps: ignore dependencies (dangerous!).

     """

     platform = get_platform(host)

-    # Only supports RHEL 8+ and Fedora for now

-    if platform in ('rhel', 'fedora'):

-        install_cmd = ['/usr/bin/dnf', 'remove', '-y']

-    elif platform in ('ubuntu'):

-        install_cmd = ['apt-get', 'remove', '-y']

+    if platform not in ('rhel', 'fedora', 'ubuntu'):

+        raise ValueError('uninstall_packages: unknown platform %s' % platform)

+    if nodeps:

+        if platform in ('rhel', 'fedora'):

+            cmd = "rpm -e --nodeps"

+        elif platform in ('ubuntu'):

+            cmd = "dpkg -P --force-depends"

+        for package in pkgs:

+            uninstall_cmd = shlex.split(cmd)

+            uninstall_cmd.append(package)

+            # keep raiseonerr=True here. --fcami

+            host.run_command(uninstall_cmd)

     else:

-        raise ValueError('install_packages: unknown platform %s' % platform)

-    host.run_command(install_cmd + pkgs, raiseonerr=False)

+        if platform in ('rhel', 'fedora'):

+            cmd = "/usr/bin/dnf remove -y"

+        elif platform in ('ubuntu'):

+            cmd = "apt-get remove -y"

+        uninstall_cmd = shlex.split(cmd)

+        uninstall_cmd.extend(pkgs)

+        host.run_command(uninstall_cmd, raiseonerr=False)

 def wait_for_request(host, request_id, timeout=120):

@@ -2649,3 +2663,20 @@ def run_ssh_cmd(

             assert "Authentication succeeded" not in stderr

             assert "No more authentication methods to try." in stderr

     return (return_code, stdout, stderr)

+

+

+def is_package_installed(host, pkg):

+    platform = get_platform(host)

+    if platform in ('rhel', 'fedora'):

+        result = host.run_command(

+            ['rpm', '-q', pkg], raiseonerr=False

+        )

+    elif platform in ['ubuntu']:

+        result = host.run_command(

+            ['dpkg', '-s', pkg], raiseonerr=False

+        )

+    else:

+        raise ValueError(

+            'is_package_installed: unknown platform %s' % platform

+        )

+    return result.returncode == 0

-- 

2.29.2

From fe157ca349e3146a53884e90e6e588efb4e97eeb Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>

Date: Thu, 10 Dec 2020 08:15:22 +0200

Subject: [PATCH] ipa-client-install: output a warning if sudo is not present

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Fixes: https://pagure.io/freeipa/issue/8530

Signed-off-by: François Cami <fcami@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: Armando Neto <abiagion@redhat.com>

Reviewed-By: Michal Polovka <mpolovka@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: Armando Neto <abiagion@redhat.com>

Reviewed-By: Michal Polovka <mpolovka@redhat.com>

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

---

 ipaclient/install/client.py | 14 +++++++++++++-

 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py

index 8acfa0cd1..0e478fa26 100644

--- a/ipaclient/install/client.py

+++ b/ipaclient/install/client.py

@@ -24,6 +24,7 @@ import re

 import SSSDConfig

 import shutil

 import socket

+import subprocess

 import sys

 import tempfile

 import textwrap

@@ -2200,7 +2201,18 @@ def install_check(options):

             "authentication resources",

             rval=CLIENT_INSTALL_ERROR)

-    # when installing with '--no-sssd' option, check whether nss-ldap is

+    # When installing without the "--no-sudo" option, check whether sudo is

+    # available.

+    if options.conf_sudo:

+        try:

+            subprocess.Popen(['sudo -V'])

+        except FileNotFoundError:

+            logger.info(

+                "The sudo binary does not seem to be present on this "

+                "system. Please consider installing sudo if required."

+            )

+

+    # when installing with the '--no-sssd' option, check whether nss-ldap is

     # installed

     if not options.sssd:

         if not os.path.exists(paths.PAM_KRB5_SO):

-- 

2.29.2

From ee0ba2df41cf545b82d3d26e7e7e42447bb0f63e Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>

Date: Thu, 10 Dec 2020 07:55:16 +0200

Subject: [PATCH] freeipa.spec: client: depend on libsss_sudo and sudo

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

On 10.10+ releases of Dogtag, the PKI installer will not depend

on sudo anymore. This opens the possibility of creating IPA servers

without a properly configured sudo.

In fact, even IPA clients should have sudo and libsss_sudo installed

in most cases, so add a weak dependency on both of them to the client

subpackage.

Also make sure libsss_sudo is installed if sudo is present.

Fixes: https://pagure.io/freeipa/issue/8530

Signed-off-by: François Cami <fcami@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: Armando Neto <abiagion@redhat.com>

Reviewed-By: Michal Polovka <mpolovka@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: Armando Neto <abiagion@redhat.com>

Reviewed-By: Michal Polovka <mpolovka@redhat.com>

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

---

 freeipa.spec.in | 5 +++++

 1 file changed, 5 insertions(+)

diff --git a/freeipa.spec.in b/freeipa.spec.in

index ba52a3834..93e473ac4 100755

--- a/freeipa.spec.in

+++ b/freeipa.spec.in

@@ -640,6 +640,11 @@ Requires: nfs-utils

 Requires: sssd-tools >= %{sssd_version}

 Requires(post): policycoreutils

+# https://pagure.io/freeipa/issue/8530

+Recommends: libsss_sudo

+Recommends: sudo

+Requires: (libsss_sudo if sudo)

+

 Provides: %{alt_name}-client = %{version}

 Conflicts: %{alt_name}-client

 Obsoletes: %{alt_name}-client < %{version}

-- 

2.29.2