Change in vdsm[ovirt-3.4]: tool: moving setup booleans verb to be part of the configura...

ybronhei at redhat.com ybronhei at redhat.com
Sat Oct 25 15:10:55 UTC 2014


Yaniv Bronhaim has uploaded a new change for review.

Change subject: tool: moving setup booleans verb to be part of the configurators
......................................................................

tool: moving setup booleans verb to be part of the configurators

This patch gets the same change-id as http://gerrit.ovirt.org/#/c/34445
although it includes changes to fit 3.4 code.

In this patch I don't remove the old seboolsetup verb to keep the call
to sebool-unconfig. In 3.4 we don't have remove-config verb in vdsm-tool

Change-Id: Icc97ba04c3b3463ae353815cdcf77b2212644e99
Signed-off-by: Yaniv Bronhaim <ybronhei at redhat.com>
---
M lib/vdsm/tool/configurator.py
M vdsm.spec.in
2 files changed, 71 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/65/34465/1

diff --git a/lib/vdsm/tool/configurator.py b/lib/vdsm/tool/configurator.py
index 7364a4a..50c3430 100644
--- a/lib/vdsm/tool/configurator.py
+++ b/lib/vdsm/tool/configurator.py
@@ -198,9 +198,80 @@
         return configured
 
 
+class SEBoolModuleConfigure(_ModuleConfigure):
+    SEBOOL_ENABLED = "on"
+    SEBOOL_DISABLED = "off"
+
+    VDSM_SEBOOL_LIST = (
+        "virt_use_fusefs",
+        "virt_use_nfs",
+        "virt_use_samba",
+        "virt_use_sanlock",
+        "sanlock_use_fusefs",
+        "sanlock_use_nfs",
+        "sanlock_use_samba",
+    )
+
+    def getName(self):
+        return 'sebool'
+
+    def _setup_booleans(self, status):
+        # loading seobject is slow. Deferring its loading can reduce VDSM
+        # startings time, because most utilities are and will be moved
+        # to vdsm-tool.
+        import seobject
+
+        sebool_obj = seobject.booleanRecords()
+        sebool_status = sebool_obj.get_all()
+
+        sebool_obj.start()
+
+        for sebool_variable in SEBoolModuleConfigure.VDSM_SEBOOL_LIST:
+            if status and not all(sebool_status[sebool_variable]):
+                sebool_obj.modify(sebool_variable,
+                                  SEBoolModuleConfigure.SEBOOL_ENABLED)
+
+            if not status and any(sebool_status[sebool_variable]):
+                sebool_obj.modify(sebool_variable,
+                                  SEBoolModuleConfigure.SEBOOL_DISABLED)
+
+        sebool_obj.finish()
+
+    def isconfigured(self):
+        """
+        True all selinux booleans in the list above are set properly
+        """
+        import seobject
+        ret = CONFIGURED
+
+        sebool_obj = seobject.booleanRecords()
+        sebool_status = sebool_obj.get_all()
+
+        for sebool_variable in SEBoolModuleConfigure.VDSM_SEBOOL_LIST:
+            if not all(sebool_status[sebool_variable]):
+                ret = NOT_CONFIGURED
+
+        return ret
+
+    def configure(self):
+        """
+        Configure selinux booleans (see list above)
+        """
+        if utils.get_selinux_enforce_mode() > -1:
+            self._setup_booleans(True)
+
+    def removeConf(self):
+        """
+        Disabling selinux booleans (see list above)
+        """
+        if utils.get_selinux_enforce_mode() > -1:
+            self._setup_booleans(False)
+
+
 __configurers = (
     LibvirtModuleConfigure(),
     SanlockModuleConfigure(),
+    SEBoolModuleConfigure(),
 )
 
 
diff --git a/vdsm.spec.in b/vdsm.spec.in
index 102f7ec..8b2e947 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -693,7 +693,6 @@
 
 %post
 %{_bindir}/vdsm-tool configure --module sanlock --force
-%{_bindir}/vdsm-tool sebool-config || :
 # set the vdsm "secret" password for libvirt
 %{_bindir}/vdsm-tool set-saslpasswd
 


-- 
To view, visit http://gerrit.ovirt.org/34465
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Icc97ba04c3b3463ae353815cdcf77b2212644e99
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.4
Gerrit-Owner: Yaniv Bronhaim <ybronhei at redhat.com>


More information about the vdsm-patches mailing list