On 30.06.2014 13:43, Thomas Woerner wrote:
On 06/27/2014 05:07 PM, Kevin Fenzi wrote:
> On Fri, 27 Jun 2014 12:36:32 +0200
> Stef Walter <stefw(a)redhat.com> wrote:
>
>> So this may be obvious to some of you, but how do we handle the case
>> where installed files need to be different between Fedora Server and
>> other Fedora flavors?
>
> You try and avoid that. ;)
>
>> For example for Cockpit to be installed by default we need to:
>>
>> * Add the cockpit service to all relevant zone files in
>> /usr/lib/firewalld/zones (currently owned by firewalld rpm).
>> See 'man firewalld.zone' and 'man firewalld.service'
>
> Can firewalld just add them conditionally somehow ?
> Or detect cockpit somehow and dynamically add them?
>
Adding distribution/package/spin or flavour specific configuration in
the firewalld code is not what I want to have. This could make behaviour
and/or code analysis a hard task or impossible.
>> * /etc/pam/sshd needs an addition module, for Cockpit reauthorize to
>> work with added servers. See:
>>
>>
>>
https://github.com/stefwalter/cockpit/blob/reauthorize/doc/reauthorize.md
>>
>>
>> ... and likely others.
>
> ugh.
>
> I suppose rolekit could make these changes when it enables roles?
>
I would say a role in rolekit could do this.
"Fedora Server" is not a role, and neither is "Cockpit".
For this particular case, I've sent an email to the openssh maintainer
to see if perhaps we can have an optional pam.d include that we then
populate.
>> So I guess the question is how do we adapt behavior of rpms
that are
>> installed both on Fedora Server *and* on other Fedora flavors.
>
> You should not and cannot change files in other packages from your
> package, thats just a bad idea.
>
I suggest to have configuration sub packages for server installs versus
configuration sub packages for the normal installation.
Yes, that sounds like a good solution for firewalld having different
ports open by default on different flavors of Fedora.
Cheers,
Stef