Favorite LMI Script?

Stephen Gallagher sgallagh at redhat.com
Thu Dec 12 18:00:13 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/12/2013 04:54 AM, Jan Synacek wrote:
> On 12/10/2013 07:47 PM, Russell Doty wrote:
>> I'm working on a writeup of LMIShell and need an LMIShell Script 
>> to dissect as an example. Please nominate your favorite script:
> 
<snip>
> Unfortunately, LogicalFile doesn't change anything (apart from 
> creating/removing directories).
> 
>> * Bonus points if it is used in an LMI Command.
> 
> Yes.
> 
>> * Can be extended and modified. * Bonus points if we can suggest 
>> useful changes someone could write.
> 
> I'm not sure, since it probably already does all that the provider 
> can do. It could probably display some other properties, but such 
> change wouldn't be worth it. So I fail on these two points:)
> 


I had a related discussion with Russ privately yesterday. There are
excellent reasons why we should not use the LogicalFile provider for
general-purpose file manipulation (such as CRUD of arbitrary files),
most notably that it will undermine our efforts with the other
providers to guarantee a usable state on the system[1].

However, one thing that came up in that conversation was the concept
of file ownership and permissions. I initially rejected the idea as
being too close to the arbitrary file manipulation I mentioned above.
But on further reflection,this may still be acceptable for OpenLMI
(though I still fear it's a slippery slope leading to complete file
manipulation).

The topic that brought this up was SCAP. One of the more common
reasons for an SCAP policy to fail is that file permissions and
ownership are set incorrectly. It occurs to me that *this* level of
manipulation might well be within the scope of the LogicalFile provider.


[1] Also, if someone is getting to that level of control, they're
probably using a better tool for that job, such as ansible, puppet or
augeas.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlKp+a0ACgkQeiVVYja6o6PsFQCfTTD0n92XO4qR0/KKBW+ve0jU
8Z4AnRXhPNN8o++DaydcYhvwgAic54su
=2VpJ
-----END PGP SIGNATURE-----


More information about the openlmi-devel mailing list