From abea98a9b918c0771ad10b314238b32c570f0372 Mon Sep 17 00:00:00 2001

From: François Cami <fcami@redhat.com>

Date: Aug 29 2019 06:45:12 +0000

Subject: ipatests: check that ipa-client-automount restores nsswitch.conf at uninstall time

Check that using ipa-client-install, ipa-client-automount --no-ssd, then uninstalling

both properly restores nsswitch.conf sequentially.

Related-to:: https://pagure.io/freeipa/issue/8038

Signed-off-by: François Cami <fcami@redhat.com>

Reviewed-By: Francois Cami <fcami@redhat.com>

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

Reviewed-By: Rob Critenden <rcritten@redhat.com>

Reviewed-By: François Cami <fcami@redhat.com>

---

#diff --git a/ipatests/prci_definitions/nightly_ipa-4-8.yaml b/ipatests/prci_definitions/nightly_ipa-4-8.yaml

#index ef5d2c6..f39e4b4 100644

#--- a/ipatests/prci_definitions/nightly_ipa-4-8.yaml

#+++ b/ipatests/prci_definitions/nightly_ipa-4-8.yaml

#@@ -1257,6 +1257,18 @@ jobs:

#         timeout: 9000

#         topology: *master_3client

# 

#+  fedora-30/nfs_nsswitch_restore:

#+    requires: [fedora-30/build]

#+    priority: 50

#+    job:

#+      class: RunPytest

#+      args:

#+        build_url: '{fedora-30/build_url}'

#+        test_suite: test_integration/test_nfs.py::TestIpaClientAutomountFileRestore

#+        template: *ci-master-f30

#+        timeout: 3600

#+        topology: *master_3client

#+

#   fedora-30/mask:

#     requires: [fedora-30/build]

#     priority: 50

diff --git a/ipatests/test_integration/test_nfs.py b/ipatests/test_integration/test_nfs.py

index adfc19f..0e1ef6a 100644

--- a/ipatests/test_integration/test_nfs.py

+++ b/ipatests/test_integration/test_nfs.py

@@ -15,6 +15,7 @@

 from __future__ import absolute_import

+import pytest

 import os

 import re

 import time

@@ -258,3 +259,74 @@ class TestNFS(IntegrationTest):

         time.sleep(WAIT_AFTER_UNINSTALL)

         self.cleanup()

+

+

+class TestIpaClientAutomountFileRestore(IntegrationTest):

+

+    num_clients = 1

+    topology = 'line'

+

+    @classmethod

+    def install(cls, mh):

+        tasks.install_master(cls.master, setup_dns=True)

+

+    def teardown_method(self, method):

+        tasks.uninstall_client(self.clients[0])

+

+    def nsswitch_backup_restore(

+        self,

+        no_sssd=False,

+    ):

+

+        # In order to get a more pure sum, one that ignores the Generated

+        # header and any white space we have to do a bit of work...

+        sha256nsswitch_cmd = \

+            'egrep -v "Generated|^$" /etc/nsswitch.conf | sed "s/\\s//g" ' \

+            '| sort | sha256sum'

+

+        cmd = self.clients[0].run_command(sha256nsswitch_cmd)

+        orig_sha256 = cmd.stdout_text

+

+        grep_automount_command = \

+            "grep automount /etc/nsswitch.conf | cut -d: -f2"

+

+        tasks.install_client(self.master, self.clients[0])

+        cmd = self.clients[0].run_command(grep_automount_command)

+        after_ipa_client_install = cmd.stdout_text.split()

+

+        if no_sssd:

+            ipa_client_automount_command = [

+                "ipa-client-automount", "--no-sssd", "-U"

+            ]

+        else:

+            ipa_client_automount_command = [

+                "ipa-client-automount", "-U"

+            ]

+        self.clients[0].run_command(ipa_client_automount_command)

+        cmd = self.clients[0].run_command(grep_automount_command)

+        after_ipa_client_automount = cmd.stdout_text.split()

+        if no_sssd:

+            assert after_ipa_client_automount == ['files', 'ldap']

+        else:

+            assert after_ipa_client_automount == ['sss', 'files']

+

+        cmd = self.clients[0].run_command(grep_automount_command)

+        assert cmd.stdout_text.split() == after_ipa_client_automount

+

+        self.clients[0].run_command([

+            "ipa-client-automount", "--uninstall", "-U"

+        ])

+

+        cmd = self.clients[0].run_command(grep_automount_command)

+        assert cmd.stdout_text.split() == after_ipa_client_install

+

+        tasks.uninstall_client(self.clients[0])

+        cmd = self.clients[0].run_command(sha256nsswitch_cmd)

+        assert cmd.stdout_text == orig_sha256

+

+    @pytest.mark.xfail(reason='freeipa ticket 8054', strict=True)

+    def test_nsswitch_backup_restore_sssd(self):

+        self.nsswitch_backup_restore()

+

+    def test_nsswitch_backup_restore_no_sssd(self):

+        self.nsswitch_backup_restore(no_sssd=True)

From 2f0afeda6e66fcca5c184a4036112fcd315f2f6e Mon Sep 17 00:00:00 2001

From: François Cami <fcami@redhat.com>

Date: Aug 29 2019 06:45:12 +0000

Subject: ipa-client-automount: always restore nsswitch.conf at uninstall time

ipa-client-automount used to only restore nsswitch.conf when sssd was not

used. However authselect's default profile is now sssd so always restore

nsswitch.conf's automount configuration to 'files sssd'.

Note that the behavior seen before commit:

a0e846f56c8de3b549d1d284087131da13135e34

would always restore nsswitch.conf to the previous state which in some cases

was wrong.

Fixes: https://pagure.io/freeipa/issue/8038

Signed-off-by: François Cami <fcami@redhat.com>

Reviewed-By: Francois Cami <fcami@redhat.com>

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

Reviewed-By: Rob Critenden <rcritten@redhat.com>

Reviewed-By: François Cami <fcami@redhat.com>

---

diff --git a/ipaclient/install/ipa_client_automount.py b/ipaclient/install/ipa_client_automount.py

index fa07598..a1dc2a1 100644

--- a/ipaclient/install/ipa_client_automount.py

+++ b/ipaclient/install/ipa_client_automount.py

@@ -177,18 +177,30 @@ def configure_xml(fstore):

         print("Configured %s" % authconf)

-def configure_nsswitch(fstore, options):

+def configure_nsswitch(statestore, options):

     """

-    Point automount to ldap in nsswitch.conf. This function is for non-SSSD

-    setups only

+    Point automount to ldap in nsswitch.conf.

+    This function is for non-SSSD setups only.

     """

-    fstore.backup_file(paths.NSSWITCH_CONF)

-

     conf = ipachangeconf.IPAChangeConf("IPA Installer")

     conf.setOptionAssignment(':')

-    nss_value = ' files ldap'

+    with open(paths.NSSWITCH_CONF, 'r') as f:

+        current_opts = conf.parse(f)

+        current_nss_value = conf.findOpts(

+            current_opts, name='automount', type='option'

+        )[1]

+        if current_nss_value is None:

+            # no automount database present

+            current_nss_value = False  # None cannot be backed up

+        else:

+            current_nss_value = current_nss_value['value']

+        statestore.backup_state(

+            'ipa-client-automount-nsswitch', 'previous-automount',

+            current_nss_value

+        )

+    nss_value = ' files ldap'

     opts = [

         {

             'name': 'automount',

@@ -198,7 +210,6 @@ def configure_nsswitch(fstore, options):

         },

         {'name': 'empty', 'type': 'empty'},

     ]

-

     conf.changeConf(paths.NSSWITCH_CONF, opts)

     print("Configured %s" % paths.NSSWITCH_CONF)

@@ -322,19 +333,47 @@ def configure_autofs_common(fstore, statestore, options):

 def uninstall(fstore, statestore):

     RESTORE_FILES = [

         paths.SYSCONFIG_AUTOFS,

-        paths.NSSWITCH_CONF,

         paths.AUTOFS_LDAP_AUTH_CONF,

         paths.SYSCONFIG_NFS,

         paths.IDMAPD_CONF,

     ]

     STATES = ['autofs', 'rpcidmapd', 'rpcgssd']

-    # automount only touches /etc/nsswitch.conf if LDAP is

-    # used. Don't restore it otherwise.

-    if statestore.get_state('authconfig', 'sssd') or (

-        statestore.get_state('authselect', 'profile') == 'sssd'

-    ):

-        RESTORE_FILES.remove(paths.NSSWITCH_CONF)

+    if statestore.get_state(

+        'ipa-client-automount-nsswitch', 'previous-automount'

+    ) is False:

+        # Previous nsswitch.conf had no automount database configured

+        # so remove it.

+        conf = ipachangeconf.IPAChangeConf("IPA automount installer")

+        conf.setOptionAssignment(':')

+        changes = [conf.rmOption('automount')]

+        conf.changeConf(paths.NSSWITCH_CONF, changes)

+        tasks.restore_context(paths.NSSWITCH_CONF)

+        statestore.delete_state(

+            'ipa-client-automount-nsswitch', 'previous-automount'

+        )

+    elif statestore.get_state(

+        'ipa-client-automount-nsswitch', 'previous-automount'

+    ) is not None:

+        nss_value = statestore.get_state(

+            'ipa-client-automount-nsswitch', 'previous-automount'

+        )

+        opts = [

+            {

+                'name': 'automount',

+                'type': 'option',

+                'action': 'set',

+                'value': nss_value,

+            },

+            {'name': 'empty', 'type': 'empty'},

+        ]

+        conf = ipachangeconf.IPAChangeConf("IPA automount installer")

+        conf.setOptionAssignment(':')

+        conf.changeConf(paths.NSSWITCH_CONF, opts)

+        tasks.restore_context(paths.NSSWITCH_CONF)

+        statestore.delete_state(

+            'ipa-client-automount-nsswitch', 'previous-automount'

+        )

     if not any(fstore.has_file(f) for f in RESTORE_FILES) or not any(

         statestore.has_state(s) for s in STATES

@@ -588,7 +627,7 @@ def configure_automount():

     try:

         if not options.sssd:

-            configure_nsswitch(fstore, options)

+            configure_nsswitch(statestore, options)

         configure_nfs(fstore, statestore, options)

         if options.sssd:

             configure_autofs_sssd(fstore, statestore, autodiscover, options)

From 6e92776bfc199e9ca92e11ef3315dcecad3c9307 Mon Sep 17 00:00:00 2001

From: Rob Critenden <rcritten@redhat.com>

Date: Aug 29 2019 06:45:12 +0000

Subject: Move ipachangeconf from ipaclient.install to ipapython

This will let us call it from ipaplatform.

Mark the original location as deprecated.

Reviewed-By: Francois Cami <fcami@redhat.com>

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

Reviewed-By: Rob Critenden <rcritten@redhat.com>

Reviewed-By: François Cami <fcami@redhat.com>

---

diff --git a/install/tools/ipa-replica-conncheck.in b/install/tools/ipa-replica-conncheck.in

index 9208076..b22db11 100644

--- a/install/tools/ipa-replica-conncheck.in

+++ b/install/tools/ipa-replica-conncheck.in

@@ -22,7 +22,7 @@ from __future__ import print_function

 import logging

-import ipaclient.install.ipachangeconf

+from ipapython import ipachangeconf

 from ipapython.config import IPAOptionParser

 from ipapython.dn import DN

 from ipapython import version

@@ -229,7 +229,7 @@ def sigterm_handler(signum, frame):

 def configure_krb5_conf(realm, kdc, filename):

-    krbconf = ipaclient.install.ipachangeconf.IPAChangeConf("IPA Installer")

+    krbconf = ipachangeconf.IPAChangeConf("IPA Installer")

     krbconf.setOptionAssignment((" = ", " "))

     krbconf.setSectionNameDelimiters(("[","]"))

     krbconf.setSubSectionDelimiters(("{","}"))

diff --git a/ipaclient/install/ipachangeconf.py b/ipaclient/install/ipachangeconf.py

index a13e0ea..c51e42e 100644

--- a/ipaclient/install/ipachangeconf.py

+++ b/ipaclient/install/ipachangeconf.py

@@ -18,566 +18,18 @@

 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

 #

-import fcntl

-import logging

-import os

-import shutil

+import warnings

+from ipapython.ipachangeconf import IPAChangeConf as realIPAChangeConf

-import six

-if six.PY3:

-    unicode = str

+class IPAChangeConf(realIPAChangeConf):

+    """Advertise the old name"""

-logger = logging.getLogger(__name__)

-

-def openLocked(filename, perms):

-    fd = -1

-    try:

-        fd = os.open(filename, os.O_RDWR | os.O_CREAT, perms)

-

-        fcntl.lockf(fd, fcntl.LOCK_EX)

-    except OSError as e:

-        if fd != -1:

-            try:

-                os.close(fd)

-            except OSError:

-                pass

-        raise IOError(e.errno, e.strerror)

-    return os.fdopen(fd, "r+")

-

-

-    #TODO: add subsection as a concept

-    #      (ex. REALM.NAME = { foo = x bar = y } )

-    #TODO: put section delimiters as separating element of the list

-    #      so that we can process multiple sections in one go

-    #TODO: add a comment all but provided options as a section option

-class IPAChangeConf:

     def __init__(self, name):

-        self.progname = name

-        self.indent = ("", "", "")

-        self.assign = (" = ", "=")

-        self.dassign = self.assign[0]

-        self.comment = ("#",)

-        self.dcomment = self.comment[0]

-        self.eol = ("\n",)

-        self.deol = self.eol[0]

-        self.sectnamdel = ("[", "]")

-        self.subsectdel = ("{", "}")

-        self.case_insensitive_sections = True

-

-    def setProgName(self, name):

-        self.progname = name

-

-    def setIndent(self, indent):

-        if type(indent) is tuple:

-            self.indent = indent

-        elif type(indent) is str:

-            self.indent = (indent, )

-        else:

-            raise ValueError('Indent must be a list of strings')

-

-    def setOptionAssignment(self, assign):

-        if type(assign) is tuple:

-            self.assign = assign

-        else:

-            self.assign = (assign, )

-        self.dassign = self.assign[0]

-

-    def setCommentPrefix(self, comment):

-        if type(comment) is tuple:

-            self.comment = comment

-        else:

-            self.comment = (comment, )

-        self.dcomment = self.comment[0]

-

-    def setEndLine(self, eol):

-        if type(eol) is tuple:

-            self.eol = eol

-        else:

-            self.eol = (eol, )

-        self.deol = self.eol[0]

-

-    def setSectionNameDelimiters(self, delims):

-        self.sectnamdel = delims

-

-    def setSubSectionDelimiters(self, delims):

-        self.subsectdel = delims

-

-    def matchComment(self, line):

-        for v in self.comment:

-            if line.lstrip().startswith(v):

-                return line.lstrip()[len(v):]

-        return False

-

-    def matchEmpty(self, line):

-        if line.strip() == "":

-            return True

-        return False

-

-    def matchSection(self, line):

-        cl = "".join(line.strip().split())

-        cl = cl.lower() if self.case_insensitive_sections else cl

-

-        if len(self.sectnamdel) != 2:

-            return False

-        if not cl.startswith(self.sectnamdel[0]):

-            return False

-        if not cl.endswith(self.sectnamdel[1]):

-            return False

-        return cl[len(self.sectnamdel[0]):-len(self.sectnamdel[1])]

-

-    def matchSubSection(self, line):

-        if self.matchComment(line):

-            return False

-

-        parts = line.split(self.dassign, 1)

-        if len(parts) < 2:

-            return False

-

-        if parts[1].strip() == self.subsectdel[0]:

-            return parts[0].strip()

-

-        return False

-

-    def matchSubSectionEnd(self, line):

-        if self.matchComment(line):

-            return False

-

-        if line.strip() == self.subsectdel[1]:

-            return True

-

-        return False

-

-    def getSectionLine(self, section):

-        if len(self.sectnamdel) != 2:

-            return section

-        return self._dump_line(self.sectnamdel[0],

-                               section,

-                               self.sectnamdel[1],

-                               self.deol)

-

-    def _dump_line(self, *args):

-        return u"".join(unicode(x) for x in args)

-

-    def dump(self, options, level=0):

-        output = []

-        if level >= len(self.indent):

-            level = len(self.indent) - 1

-

-        for o in options:

-            if o['type'] == "section":

-                output.append(self._dump_line(self.sectnamdel[0],

-                                              o['name'],

-                                              self.sectnamdel[1]))

-                output.append(self.dump(o['value'], (level + 1)))

-                continue

-            if o['type'] == "subsection":

-                output.append(self._dump_line(self.indent[level],

-                                              o['name'],

-                                              self.dassign,

-                                              self.subsectdel[0]))

-                output.append(self.dump(o['value'], (level + 1)))

-                output.append(self._dump_line(self.indent[level],

-                                              self.subsectdel[1]))

-                continue

-            if o['type'] == "option":

-                delim = o.get('delim', self.dassign)

-                if delim not in self.assign:

-                    raise ValueError('Unknown delim "%s" must be one of "%s"' % (delim, " ".join([d for d in self.assign])))

-                output.append(self._dump_line(self.indent[level],

-                                              o['name'],

-                                              delim,

-                                              o['value']))

-                continue

-            if o['type'] == "comment":

-                output.append(self._dump_line(self.dcomment, o['value']))

-                continue

-            if o['type'] == "empty":

-                output.append('')

-                continue

-            raise SyntaxError('Unknown type: [%s]' % o['type'])

-

-        # append an empty string to the output so that we add eol to the end

-        # of the file contents in a single join()

-        output.append('')

-        return self.deol.join(output)

-

-    def parseLine(self, line):

-

-        if self.matchEmpty(line):

-            return {'name': 'empty', 'type': 'empty'}

-

-        value = self.matchComment(line)

-        if value:

-            return {'name': 'comment',

-                    'type': 'comment',

-                    'value': value.rstrip()}  # pylint: disable=E1103

-

-        o = dict()

-        parts = line.split(self.dassign, 1)

-        if len(parts) < 2:

-            # The default assign didn't match, try the non-default

-            for d in self.assign[1:]:

-                parts = line.split(d, 1)

-                if len(parts) >= 2:

-                    o['delim'] = d

-                    break

-

-            if 'delim' not in o:

-                raise SyntaxError('Syntax Error: Unknown line format')

-

-        o.update({'name':parts[0].strip(), 'type':'option', 'value':parts[1].rstrip()})

-        return o

-

-    def findOpts(self, opts, type, name, exclude_sections=False):

-

-        num = 0

-        for o in opts:

-            if o['type'] == type and o['name'] == name:

-                return (num, o)

-            if exclude_sections and (o['type'] == "section" or

-                                     o['type'] == "subsection"):

-                return (num, None)

-            num += 1

-        return (num, None)

-

-    def commentOpts(self, inopts, level=0):

-

-        opts = []

-

-        if level >= len(self.indent):

-            level = len(self.indent) - 1

-

-        for o in inopts:

-            if o['type'] == 'section':

-                no = self.commentOpts(o['value'], (level + 1))

-                val = self._dump_line(self.dcomment,

-                                      self.sectnamdel[0],

-                                      o['name'],

-                                      self.sectnamdel[1])

-                opts.append({'name': 'comment',

-                             'type': 'comment',

-                             'value': val})

-                for n in no:

-                    opts.append(n)

-                continue

-            if o['type'] == 'subsection':

-                no = self.commentOpts(o['value'], (level + 1))

-                val = self._dump_line(self.indent[level],

-                                      o['name'],

-                                      self.dassign,

-                                      self.subsectdel[0])

-                opts.append({'name': 'comment',

-                             'type': 'comment',

-                             'value': val})

-                opts.extend(no)

-                val = self._dump_line(self.indent[level], self.subsectdel[1])

-                opts.append({'name': 'comment',

-                             'type': 'comment',

-                             'value': val})

-                continue

-            if o['type'] == 'option':

-                delim = o.get('delim', self.dassign)

-                if delim not in self.assign:

-                    val = self._dump_line(self.indent[level],

-                                          o['name'],

-                                          delim,

-                                          o['value'])

-                opts.append({'name':'comment', 'type':'comment', 'value':val})

-                continue

-            if o['type'] == 'comment':

-                opts.append(o)

-                continue

-            if o['type'] == 'empty':

-                opts.append({'name': 'comment',

-                             'type': 'comment',

-                             'value': ''})

-                continue

-            raise SyntaxError('Unknown type: [%s]' % o['type'])

-

-        return opts

-

-    def mergeOld(self, oldopts, newopts):

-

-        opts = []

-

-        for o in oldopts:

-            if o['type'] == "section" or o['type'] == "subsection":

-                _num, no = self.findOpts(newopts, o['type'], o['name'])

-                if not no:

-                    opts.append(o)

-                    continue

-                if no['action'] == "set":

-                    mo = self.mergeOld(o['value'], no['value'])

-                    opts.append({'name': o['name'],

-                                 'type': o['type'],

-                                 'value': mo})

-                    continue

-                if no['action'] == "comment":

-                    co = self.commentOpts(o['value'])

-                    for c in co:

-                        opts.append(c)

-                    continue

-                if no['action'] == "remove":

-                    continue

-                raise SyntaxError('Unknown action: [%s]' % no['action'])

-

-            if o['type'] == "comment" or o['type'] == "empty":

-                opts.append(o)

-                continue

-

-            if o['type'] == "option":

-                _num, no = self.findOpts(newopts, 'option', o['name'], True)

-                if not no:

-                    opts.append(o)

-                    continue

-                if no['action'] == 'comment' or no['action'] == 'remove':

-                    if (no['value'] is not None and

-                            o['value'] is not no['value']):

-                        opts.append(o)

-                        continue

-                    if no['action'] == 'comment':

-                        value = self._dump_line(self.dcomment,

-                                                o['name'],

-                                                self.dassign,

-                                                o['value'])

-                        opts.append({'name': 'comment',

-                                     'type': 'comment',

-                                     'value': value})

-                    continue

-                if no['action'] == 'set':

-                    opts.append(no)

-                    continue

-                if no['action'] == 'addifnotset':

-                    opts.append({

-                        'name': 'comment',

-                        'type': 'comment',

-                        'value': self._dump_line(

-                            ' ', no['name'], ' modified by IPA'

-                        ),

-                    })

-                    opts.append({'name': 'comment', 'type': 'comment',

-                                'value': self._dump_line(no['name'],

-                                                         self.dassign,

-                                                         no['value'],

-                                                         )})

-                    opts.append(o)

-                    continue

-                raise SyntaxError('Unknown action: [%s]' % no['action'])

-

-            raise SyntaxError('Unknown type: [%s]' % o['type'])

-

-        return opts

-

-    def mergeNew(self, opts, newopts):

-

-        cline = 0

-

-        for no in newopts:

-

-            if no['type'] == "section" or no['type'] == "subsection":

-                (num, o) = self.findOpts(opts, no['type'], no['name'])

-                if not o:

-                    if no['action'] == 'set':

-                        opts.append(no)

-                    continue

-                if no['action'] == "set":

-                    self.mergeNew(o['value'], no['value'])

-                    continue

-                cline = num + 1

-                continue

-

-            if no['type'] == "option":

-                (num, o) = self.findOpts(opts, no['type'], no['name'], True)

-                if not o:

-                    if no['action'] == 'set' or no['action'] == 'addifnotset':

-                        opts.append(no)

-                    continue

-                cline = num + 1

-                continue

-

-            if no['type'] == "comment" or no['type'] == "empty":

-                opts.insert(cline, no)

-                cline += 1

-                continue

-

-            raise SyntaxError('Unknown type: [%s]' % no['type'])

-

-    def merge(self, oldopts, newopts):

-        """

-        Uses a two pass strategy:

-        First we create a new opts tree from oldopts removing/commenting

-          the options as indicated by the contents of newopts

-        Second we fill in the new opts tree with options as indicated

-          in the newopts tree (this is becaus eentire (sub)sections may

-          in the newopts tree (this is becaus entire (sub)sections may

-          exist in the newopts that do not exist in oldopts)

-        """

-        opts = self.mergeOld(oldopts, newopts)

-        self.mergeNew(opts, newopts)

-        return opts

-

-    #TODO: Make parse() recursive?

-    def parse(self, f):

-