Dominik Vogt via FreeIPA-users wrote:
On Mon, Sep 21, 2020 at 09:46:07AM -0400, Rob Crittenden via
FreeIPA-users wrote:
> Dominik Vogt via FreeIPA-users wrote:
>> The config-mod commands generates an error if it does not change
>> anything:
>>
>> $ ipa config-mod --ipaselinuxusermap="....."
>> ipa: ERROR: no modifications to be performed
>>
>> As for real errors, the return code is 1, so this cannot be used
>> to detect "nothing to be done" errors.
>>
>> This makes it very inconvenient to write scripts that overwrite a
>> value and do not care what the current value is. Is there an easy
>> way to suppress this kind of errors?
>
> No.
>>
>> (This is also a problem for other "add" commands like user-add,
>> group-add, selinuxusermap-add etc.)
>
> What's the problem? Can you provide some examples?
Sure.
$ ipa group-add foo
# OK
$ ipa group-add foo
ipa: ERROR: group with name "foo" already exists
$ ipa selinuxusermap-add some_map --selinuxuser=staff_u:s0-s0:c0.c0123
# OK
$ ipa selinuxusermap-add some_map --selinuxuser=staff_u:s0-s0:c0.c0123
ipa: ERROR: ... already exists
$ ipa selinuxusermap-add-user --user=foo some_map; echo $?
0
$ ipa selinuxusermap-add-user --user=foo some_map; echo $?
1
# (no real error message)
Same with other commands that don't have an option to suppress
"nothing to be done" errors. That's all fine for manual work, but
it makes scripting more tedious.
Returning a separate error coded for each type of possible exception
isn't scalable.
For the case of adding/removing members it only returns 1 if the command
failed. It is independent of whether any members were added or removed
since there can be a mix of success and failure.
There have been inquiries in the past to see if we could return the raw
json output but there was no issue filed that I can find.
rob