From 337c5418556f5daed14dd8c8fb064ae1774c3dcd Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Mar 05 2015 13:19:28 +0000 Subject: import pcs-0.9.137-13.el7 --- diff --git a/.gitignore b/.gitignore index ae6f95b..be8cd56 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ SOURCES/HAM-logo.png -SOURCES/pcs-withgems-0.9.115.tar.gz +SOURCES/clufter-0.3.0.tar.gz +SOURCES/pcs-withgems-0.9.137.tar.gz diff --git a/.pcs.metadata b/.pcs.metadata index 2c535af..6e63147 100644 --- a/.pcs.metadata +++ b/.pcs.metadata @@ -1,2 +1,3 @@ 80dc7788a3468fb7dd362a4b8bedd9efb373de89 SOURCES/HAM-logo.png -d722cc45738b913dc4f74257596db8788ba089ed SOURCES/pcs-withgems-0.9.115.tar.gz +5a4d023ca35d952e52c2a8bc11c96c7fefb57b6d SOURCES/clufter-0.3.0.tar.gz +08ab97a1378ba9dcd08c5b5fccce243fffba6bff SOURCES/pcs-withgems-0.9.137.tar.gz diff --git a/SOURCES/bz1054491-Add-acl-enable-and-disable-commands-3.patch b/SOURCES/bz1054491-Add-acl-enable-and-disable-commands-3.patch new file mode 100644 index 0000000..89741a1 --- /dev/null +++ b/SOURCES/bz1054491-Add-acl-enable-and-disable-commands-3.patch @@ -0,0 +1,115 @@ +From 3732bb03e2f0b710e85b502c772ad7174d91db80 Mon Sep 17 00:00:00 2001 +From: Tomas Jelinek +Date: Thu, 8 Jan 2015 16:00:47 +0100 +Subject: [PATCH] Add acl enable and disable commands + +* add acl enable and disable commands +* display whether acls are enabled in the 'pcs acl' output +--- + pcs/acl.py | 19 +++++++++++++ + pcs/pcs.8 | 6 ++++ + pcs/usage.py | 6 ++++ + pcs/utils.py | 5 ++++ + 5 files changed, 92 insertions(+), 21 deletions(-) + +diff --git a/pcs/acl.py b/pcs/acl.py +index aa07d40..4c2d696 100644 +--- a/pcs/acl.py ++++ b/pcs/acl.py +@@ -1,6 +1,7 @@ + import sys + import usage + import utils ++import prop + + def acl_cmd(argv): + if len(argv) == 0: +@@ -18,6 +19,10 @@ def acl_cmd(argv): + acl_show(argv) + # elif (sub_cmd == "grant"): + # acl_grant(argv) ++ elif (sub_cmd == "enable"): ++ acl_enable(argv) ++ elif (sub_cmd == "disable"): ++ acl_disable(argv) + elif (sub_cmd == "role"): + acl_role(argv) + elif (sub_cmd == "target" or sub_cmd == "user"): +@@ -33,10 +38,24 @@ def acl_cmd(argv): + def acl_show(argv): + dom = utils.get_cib_dom() + ++ properties = prop.get_set_properties(defaults=prop.get_default_properties()) ++ acl_enabled = properties.get("enable-acl", "").lower() ++ if utils.is_cib_true(acl_enabled): ++ print "ACLs are enabled" ++ else: ++ print "ACLs are disabled, run 'pcs acl enable' to enable" ++ print ++ + print_targets(dom) + print_groups(dom) + print_roles(dom) + ++def acl_enable(argv): ++ prop.set_property(["enable-acl=true"]) ++ ++def acl_disable(argv): ++ prop.set_property(["enable-acl=false"]) ++ + def acl_grant(argv): + print "Not yet implemented" + +diff --git a/pcs/pcs.8 b/pcs/pcs.8 +index 00ac11b..14917f7 100644 +--- a/pcs/pcs.8 ++++ b/pcs/pcs.8 +@@ -316,6 +316,12 @@ Confirm that the host specified is currently down. WARNING: if this node is not + [show] + List all current access control lists + .TP ++enable ++Enable access control lists ++.TP ++disable ++Disable access control lists ++.TP + role create [description=] [((read | write | deny) (xpath | id ))...] + Create a role with the name and (optional) description specified. + Each role can also have an unlimited number of permissions +diff --git a/pcs/usage.py b/pcs/usage.py +index 7bd3368..2c39901 100644 +--- a/pcs/usage.py ++++ b/pcs/usage.py +@@ -969,6 +969,12 @@ Commands: + [show] + List all current access control lists + ++ enable ++ Enable access control lists ++ ++ disable ++ Disable access control lists ++ + role create [description=] [((read | write | deny) + (xpath | id ))...] + Create a role with the name and (optional) description specified. +diff --git a/pcs/utils.py b/pcs/utils.py +index 8713c81..de000fa 100644 +--- a/pcs/utils.py ++++ b/pcs/utils.py +@@ -2129,6 +2129,11 @@ def is_iso8601_date(var): + output, retVal = run(["iso8601", "-d", var]) + return retVal == 0 + ++# Does pacemaker consider a variable as true in cib? ++# See crm_is_true in pacemaker/lib/common/utils.c ++def is_cib_true(var): ++ return var.lower() in ("true", "on", "yes", "y", "1") ++ + def is_systemctl(): + if os.path.exists('/usr/bin/systemctl'): + return True +-- +1.9.1 + diff --git a/SOURCES/bz1054491-Delete-a-user-group-when-deleting-its-last-role-in-GUI.patch b/SOURCES/bz1054491-Delete-a-user-group-when-deleting-its-last-role-in-GUI.patch new file mode 100644 index 0000000..0e53c7d --- /dev/null +++ b/SOURCES/bz1054491-Delete-a-user-group-when-deleting-its-last-role-in-GUI.patch @@ -0,0 +1,45 @@ +From 50333856badcd0dd6d0f4e4876fd605738317ef9 Mon Sep 17 00:00:00 2001 +From: Tomas Jelinek +Date: Wed, 7 Jan 2015 13:08:26 +0100 +Subject: [PATCH] Delete a user/group when deleting its last ACl role in GUI + +--- + pcs/acl.py | 6 +++++- + pcsd/remote.rb | 4 +++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/pcs/acl.py b/pcs/acl.py +index cbaef37..aa07d40 100644 +--- a/pcs/acl.py ++++ b/pcs/acl.py +@@ -107,7 +107,11 @@ def acl_role(argv): + # Remove any references to this role in acl_target or acl_group + for elem in dom.getElementsByTagName("role"): + if elem.getAttribute("id") == role_id: +- elem.parentNode.removeChild(elem) ++ user_group = elem.parentNode ++ user_group.removeChild(elem) ++ if "--autodelete" in utils.pcs_options: ++ if not user_group.getElementsByTagName("role"): ++ user_group.parentNode.removeChild(user_group) + + utils.replace_cib_configuration(dom) + elif command == "assign": +diff --git a/pcsd/remote.rb b/pcsd/remote.rb +index 2e898ab..9709941 100644 +--- a/pcsd/remote.rb ++++ b/pcsd/remote.rb +@@ -914,7 +914,9 @@ def remove_acl_roles_remote(params) + errors = "" + params.each { |name, value| + if name.index("role-") == 0 +- out, errout, retval = run_cmd(PCS, "acl", "role", "delete", value.to_s) ++ out, errout, retval = run_cmd( ++ PCS, "acl", "role", "delete", value.to_s, "--autodelete" ++ ) + if retval != 0 + errors += "Unable to remove role #{value}" + unless errout.include?("cib_replace failure") +-- +1.9.1 + diff --git a/SOURCES/bz1054491-Fix-acl-add-duplicate-names-and-remove-roles-in-GUI.patch b/SOURCES/bz1054491-Fix-acl-add-duplicate-names-and-remove-roles-in-GUI.patch new file mode 100644 index 0000000..bd1db38 --- /dev/null +++ b/SOURCES/bz1054491-Fix-acl-add-duplicate-names-and-remove-roles-in-GUI.patch @@ -0,0 +1,78 @@ +--- pcs-0.9.137/pcs/pcs.py.acl-fix 2014-12-19 16:23:13.264292808 -0600 ++++ pcs-0.9.137/pcs/pcs.py 2014-12-19 16:23:57.361816642 -0600 +@@ -54,7 +54,7 @@ def main(argv): + pcs_short_options_with_args.append(prev_char) + prev_char = c + +- pcs_long_options = ["local","start","all","clone","master","force","corosync_conf=", "defaults","debug","version","help","fullhelp","off","from=","to=", "name=", "wait", "group=","groups","full","enable","node=","nodesc","transport=", "addr0=","addr1=","bcast0=","bcast1=","mcast0=","mcast1=","mcastport0=","mcastport1=","ttl0=","ttl1=","rrpmode=", "broadcast0", "broadcast1","wait_for_all=","auto_tie_breaker=","last_man_standing=", "last_man_standing_window=","no-default-ops","ipv6","token=", "token_coefficient=", "consensus=", "miss_count_const=", "fail_recv_const=","join=", "disabled", "after=", "before=", "autocorrect", "interactive"] ++ pcs_long_options = ["local","start","all","clone","master","force","corosync_conf=", "defaults","debug","version","help","fullhelp","off","from=","to=", "name=", "wait", "group=","groups","full","enable","node=","nodesc","transport=", "addr0=","addr1=","bcast0=","bcast1=","mcast0=","mcast1=","mcastport0=","mcastport1=","ttl0=","ttl1=","rrpmode=", "broadcast0", "broadcast1","wait_for_all=","auto_tie_breaker=","last_man_standing=", "last_man_standing_window=","no-default-ops","ipv6","token=", "token_coefficient=", "consensus=", "miss_count_const=", "fail_recv_const=","join=", "disabled", "after=", "before=", "autocorrect", "interactive", "autodelete"] + # pull out negative number arguments and add them back after getopt + prev_arg = "" + for arg in argv: +--- pcs-0.9.137/pcs/acl.py.acl-fix 2014-10-21 09:28:55.000000000 -0500 ++++ pcs-0.9.137/pcs/acl.py 2014-12-19 16:23:13.264292808 -0600 +@@ -58,6 +58,8 @@ def acl_role(argv): + id_valid, id_error = utils.validate_xml_id(role_name, 'ACL role') + if not id_valid: + utils.err(id_error) ++ if utils.dom_get_element_with_id(dom, "acl_role", role_name): ++ utils.err("role %s already exists" % role_name) + if utils.does_id_exist(dom,role_name): + utils.err(role_name + " already exists") + +@@ -178,8 +180,13 @@ def acl_role(argv): + + if not found: + utils.err("cannot find role: %s, assigned to user/group: %s" % (role_id, ug_id)) ++ ++ if "--autodelete" in utils.pcs_options: ++ if not ug.getElementsByTagName("role"): ++ ug.parentNode.removeChild(ug) ++ + utils.replace_cib_configuration(dom) +- ++ + else: + utils.err("Unknown pcs acl role command: '" + command + "' (try create or delete)") + +@@ -198,8 +205,14 @@ def acl_target(argv,group=False): + command = argv.pop(0) + tug_id = argv.pop(0) + if command == "create": ++ # pcsd parses the error message in order to determine whether the id is ++ # assigned to user/group or some other cib element ++ if group and utils.dom_get_element_with_id(dom, "acl_group", tug_id): ++ utils.err("group %s already exists" % tug_id) ++ if not group and utils.dom_get_element_with_id(dom, "acl_target", tug_id): ++ utils.err("user %s already exists" % tug_id) + if utils.does_id_exist(dom,tug_id): +- utils.err(tug_id + " already exists in cib") ++ utils.err(tug_id + " already exists") + + if group: + element = dom.createElement("acl_group") +--- pcs-0.9.137/pcsd/pcs.rb.acl-fix 2014-11-20 02:53:57.000000000 -0600 ++++ pcs-0.9.137/pcsd/pcs.rb 2014-12-19 16:23:20.063219392 -0600 +@@ -189,8 +189,8 @@ def add_acl_usergroup(acl_role_id, user_ + if retval == 0 + return "" + end +- if stderr.join("\n").strip.downcase != "error: #{name.to_s.downcase} already exists in cib" +- return stderror.join("\n").strip ++ if not /^error: (user|group) #{name.to_s} already exists$/i.match(stderr.join("\n").strip) ++ return stderr.join("\n").strip + end + end + stdout, stderror, retval = run_cmd( +@@ -211,7 +211,10 @@ def remove_acl_permission(acl_perm_id) + end + + def remove_acl_usergroup(role_id, usergroup_id) +- stdout, stderror, retval = run_cmd(PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s) ++ stdout, stderror, retval = run_cmd( ++ PCS, "acl", "role", "unassign", role_id.to_s, usergroup_id.to_s, ++ "--autodelete" ++ ) + if retval != 0 + return stderror.join("\n").chomp + end diff --git a/SOURCES/bz1078343-Add-support-for-setting-certain-corosync-totem-optio.patch b/SOURCES/bz1078343-Add-support-for-setting-certain-corosync-totem-optio.patch deleted file mode 100644 index 0618bd8..0000000 --- a/SOURCES/bz1078343-Add-support-for-setting-certain-corosync-totem-optio.patch +++ /dev/null @@ -1,135 +0,0 @@ -From b18b74ecde9a96761df2a8e8f8d76b8c1642d161 Mon Sep 17 00:00:00 2001 -From: Chris Feist -Date: Wed, 19 Mar 2014 16:30:29 -0500 -Subject: [PATCH] Add support for setting certain corosync totem options - ---- - pcs/cluster.py | 13 +++++++++++++ - pcs/corosync.conf.fedora.template | 1 + - pcs/pcs.8 | 15 ++++++++++++++- - pcs/pcs.py | 2 +- - pcs/test/test_cluster.py | 8 ++++++++ - pcs/usage.py | 17 ++++++++++++++++- - 6 files changed, 53 insertions(+), 3 deletions(-) - -diff --git a/pcs/cluster.py b/pcs/cluster.py -index ec0e6a1..bf7acda 100644 ---- a/pcs/cluster.py -+++ b/pcs/cluster.py -@@ -371,6 +371,18 @@ def corosync_setup(argv,returnConfig=False): - ip_version = "" - - -+ totem_options = "" -+ if "--token" in utils.pcs_options: -+ totem_options += "token: " + utils.pcs_options["--token"] + "\n" -+ if "--join" in utils.pcs_options: -+ totem_options += "join: " + utils.pcs_options["--join"] + "\n" -+ if "--consensus" in utils.pcs_options: -+ totem_options += "consensus: " + utils.pcs_options["--consensus"] + "\n" -+ if "--miss_count_const" in utils.pcs_options: -+ totem_options += "miss_count_const: " + utils.pcs_options["--miss_count_const"] + "\n" -+ if "--fail_recv_const" in utils.pcs_options: -+ totem_options += "fail_recv_const: " + utils.pcs_options["--fail_recv_const"] + "\n" -+ - corosync_config = corosync_config.replace("@@nodes", new_nodes_section) - corosync_config = corosync_config.replace("@@cluster_name",cluster_name) - corosync_config = corosync_config.replace("@@quorum_options\n",quorum_options) -@@ -378,6 +390,7 @@ def corosync_setup(argv,returnConfig=False): - corosync_config = corosync_config.replace("@@transport",transport) - corosync_config = corosync_config.replace("@@interfaceandrrpmode\n",ir) - corosync_config = corosync_config.replace("@@ip_version\n",ip_version) -+ corosync_config = corosync_config.replace("@@totem_options\n",totem_options) - if returnConfig: - return corosync_config - -diff --git a/pcs/corosync.conf.fedora.template b/pcs/corosync.conf.fedora.template -index 82413c1..4d1227c 100644 ---- a/pcs/corosync.conf.fedora.template -+++ b/pcs/corosync.conf.fedora.template -@@ -3,6 +3,7 @@ version: 2 - secauth: off - cluster_name: @@cluster_name - transport: @@transport -+@@totem_options - @@interfaceandrrpmode - @@ip_version - } -diff --git a/pcs/pcs.8 b/pcs/pcs.8 -index 7f51f61..0eeadb8 100644 ---- a/pcs/pcs.8 -+++ b/pcs/pcs.8 -@@ -144,9 +144,22 @@ Reset failcount for specified resource on all nodes or only on specified node. T - auth [node] [...] [\-u username] [\-p password] [\-\-local] [\-\-force] - Authenticate pcs to pcsd on nodes specified, or on all nodes configured in corosync.conf if no nodes are specified (authorization tokens are stored in ~/.pcs/tokens or /var/lib/pcsd/tokens for root). By default all nodes are also authenticated to each other, using --local only authenticates the local node (and does not authenticate the remote nodes with each other). Using --force forces re-authentication to occur. - .TP --setup [\-\-start] [\-\-local] [\-\-enable] \-\-name\fR [node2[,node2-altaddr]] [..] [--transport ] [--rrpmode active|passive] [--addr0 [[[--mcast0
] [--mcastport0 ] [--ttl0 ]] | [--broadcast0]] [--addr1 [[[--mcast1
] [--mcastport1 ] [--ttl1 ]] | [--broadcast1]]]] [--wait_for_all=<0|1>] [--auto_tie_breaker=<0|1>] [--last_man_standing=<0|1> [--last_man_standing_window=