aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* release Consfigurator 0.12.0 (-1 to Debian unstable)v0.12.0debian/0.12.0-1archive/debian/0.12.0-1Sean Whitton2021-11-08
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* style guide: prefer to switch user than to update ownershipSean Whitton2021-11-08
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* use higher-numbered codes for change status, 1 for unhandled errorsSean Whitton2021-11-08
| | | | | | | | When SBCL fails to start up, such as when previously-loaded shared libraries cannot be found while trying to reinvoke a dumped image, it exits 1. We must avoid erroneously interpreting this as a successful attempt to make changes. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* :SBCL: avoid adding :DATA hostattrs that persist in *HOST*Sean Whitton2021-11-08
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* REHOME-CONNECTION: move call to UPLOAD-ALL-PREREQUISITE-DATASean Whitton2021-11-08
| | | | | | | | It's the fact we're changing to a different home directory that's part of the same root filesystem, and with the same UID/GID ranges, that means we call UPLOAD-ALL-PREREQUISITE-DATA with this connection object. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add LXC properties, :LXC{,-UNPRIV-ATTACH} connections, WITH-HOMEDIRSean Whitton2021-11-08
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add Linux namespace-entering connectionsSean Whitton2021-11-08
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add CAPABILITY-P and grovel for some Linux capability constantsSean Whitton2021-11-04
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* :SETUID: pass target uid to POSIX-LOGIN-ENVIRONMENT for correct PATHSean Whitton2021-11-01
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* rename FIREWALLD:ZONE-DIRECT-RULE -> FIREWALLD:DIRECT-RULESean Whitton2021-11-01
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* ON{-APPLY,}-CHANGE: always return result of primary propappSean Whitton2021-11-01
| | | | | | | In particular, if the secondary propapps are applied but make no change, do not return :NO-CHANGE as the overall result. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add APT:BACKPORTS-INSTALLED{,-MINIMALLY}Sean Whitton2021-11-01
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* FIREWALLD:ZONE: note idea to use hostattrs to gather zone settingsSean Whitton2021-11-01
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* FIREWALLD:HAS-ZONE: reload after adding zoneSean Whitton2021-11-01
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add SYSTEMD:{DAEMON-RELOADED,RELOADED,RESTARTED}Sean Whitton2021-11-01
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* firewall-cmd: --reload less often & respect SERVICE:NO-SERVICES-PSean Whitton2021-11-01
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* SYSTEMD:LINGERING-ENABLED :CHECK: handle non-zero exit from loginctlSean Whitton2021-10-29
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* CONSFIGURATOR.PROPERTY.SYSTEMD: respect :NO-SERVICES connattrSean Whitton2021-10-29
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add & propagate :NO-SERVICES connattr and respect in LIBVIRT:STARTEDSean Whitton2021-10-29
| | | | | | | | | | | | | | | | | This change was prompted by the realisation that RECONNECTS nullifies any enclosing SERVICE:WITHOUT-STARTING-SERVICES because *HOST* during RECONNECTS is a distinct HOST value, computed at hostattrs time, which can't be affected by an enclosing combinator that works by temporarily pushing hostattrs at :APPLY time. So, for example, if we chroot and subsequently establish a :SETUID connection, properties might try to start services as the non-root user and there is no way for them to know they shouldn't. We can avoid this problem by using a connattr instead because we have a mechanism for propagating connattrs to subsequently established connections. And as in most cases the reason for not starting services is solely due to the way in which we're connecting to the host, a connattr is more appropriate. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* basic systemctl(1) properties: add USER argument for --userSean Whitton2021-10-28
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* :SETUID: avoid creating user's ~/.cache/consfigurator/ owned by rootSean Whitton2021-10-28
| | | | | | This reverts and replaces commit b4eb20904aa8f4ea7ec0ef58eac7889b4b864277. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* expand remarks on portability & update in light of recent changesSean Whitton2021-10-28
| | | | | | | | We've long required package-local nicknames but this was not mentioned. We now additionally require multithreading, a C toolchain and development headers for libacl. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* IMAGE-DUMPED: also abort if shlibs not readableSean Whitton2021-10-28
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* discuss limitations which apply to dumping images with IMAGE-DUMPEDSean Whitton2021-10-28
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* IMAGE-DUMPED: support skipping when same build of SBCL unavailableSean Whitton2021-10-28
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* debian/: Run 'wrap-and-sort -abst'Sean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* debian/: Add ${sphinxdoc:Built-Using} to Built-UsingSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* LIBVIRT:KVM-BOOTS-CHROOT-FOR: ADDITIONAL-PROPERTIES usage exampleSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* HANDLE-FORK-REQUEST: use return values of BT:JOIN-THREADSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* HANDLE-FORK-REQUEST: immediately begin reading from out & err pipesSean Whitton2021-10-23
| | | | | | | Previously we waited for waitpid(2) to return before reading from the pipes. If either pipe filled up before the child process exited, we would deadlock. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* note about PROGRAMMATIC-APPLY-HOSTATTRS for DEFPROPLIST/DEFPROPSPECSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* rename :XDG-CACHE-HOME connattr to :XDG_CACHE_HOMESean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* replace some functions with a new :CONSFIGURATOR-CACHE connattrSean Whitton2021-10-23
| | | | | | This simplifies the API. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* :SETUID: error when OSICAT:USER-INFO failsSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* use PUSHNEW-HOSTATTRS when propagating :DATA hostattrsSean Whitton2021-10-23
| | | | | | This prevents multiple attempts to upload the same item of prerequisite data. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* :CHROOT.FORK: unshare mount namespace before making temporary mountsSean Whitton2021-10-23
| | | | | | | | | This avoids some cases of interference between the deployment of the chroot and other system activity. For example, before this change, the :ALWAYS-DEPLOYS option to LIBVIRT:KVM-BOOTS-CHROOT{,-FOR} could interact with Virtiofs in such a way as to break the running VM. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* RUN/MRUN: support unsetting environment variables tooSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* find XDG_CACHE_HOME without relying on HOMESean Whitton2021-10-23
| | | | | | | | | | CONNECTION-CONNATTR for :REMOTE-HOME avoids relying on the HOME environment variable having the correct value; its docstring describes a case in which HOME's value can be incorrect. As determining :XDG-CACHE-HOME depends in most cases on having the correct value for the remote home directory, don't rely on the HOME environment variable here either. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* make *FORK-CONTROL* contents survive reloads of src/image.lispSean Whitton2021-10-23
| | | | | | | In particular, reloads initiated by the call to ASDF:LOAD-SYSTEM in CONSFIGURATOR.DATA.ASDF::SYSTEM-VERSION-FILES. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* be more specific regarding POSIX and the creation of temporary dirsSean Whitton2021-10-23
| | | | | | POSIX lacks 'mktemp -d' but it does have mkdtemp(3). Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* FORK-CONNECTION POST-FORK: note that must not start up any threadsSean Whitton2021-10-23
| | | | | | Per the docstring of EVAL-IN-GRANDCHILD. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add wrappers of some system functions to manipulate POSIX.1e ACLsSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* install system deps by searching for package managers on PATHSean Whitton2021-10-23
| | | | | | | | | | | | | | | | With this change we handle the situation in which we don't know the OS of a host on which we need to install system packages more cleanly than before. Also rely on the new PACKAGE:INSTALLED to install the OS bootstrapper in INSTALLER:CLEANLY-INSTALLED-ONCE. This allows us to simplify usage of the property by replacing the ORIGINAL-OS argument with ORIGINAL-OS-ARCHITECTURE. Making this change does mean that we now have two ways to specify the different names a package has on different OSs: (i) something like OS:ETYPECASE where each branch applies a property which invokes an OS-specific package manager; and (ii) the plists supplied to PACKAGE:INSTALLED. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* IGNORING-HOSTATTRS: accept calling properties using APPLY & similarSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* factor out REMOTE-EXECUTABLE-FINDSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* SHELL-WRAP-CONNECTION %READFILE: insert space before shell "&&"Sean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* :SETUID: ensure that the data directory actually existsSean Whitton2021-10-23
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add SKIP-SEQUENCE, ABORTED-CHANGE, ESEQPROPS-UNTILSean Whitton2021-10-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We establish a SKIP-PROPERTY restart for each sequencing combinator, such that in addition to skipping over individual property applications, it is possible to abandon the whole sequence. However, that restart discards information about whether or not a change was made by the property applications of the abandoned sequence prior to the property application interrupted by an error. The new SKIP-SEQUENCE restart preserves this information by returning from the DOLIST in APPLY-AND-PRINT. The implementation of the SKIP-SEQUENCE restart must take into account the fact that the property application interrupted by the error might have made a change prior to failing. In particular, the new restart must not cause the sequencing combinator to return :NO-CHANGE unless it can infer that the property application interrupted by an error made no change. To achieve this, capture whether the interrupted property application made a change by introducing a distinction between plain FAILED-CHANGE and a new condition class, ABORTED-CHANGE. These changes permit the implementation of a new combinator, ESEQPROPS-UNTIL, which invokes SKIP-SEQUENCE when a given condition is signalled. The new combinator is like SEQPROPS in that it allows for continuing the deployment despite a signalling of FAILED-CHANGE, but it is like ESEQPROPS in not attempting to apply succeeding propapps. It also offers finer-grained control over what kinds of failures are to be tolerated than does SEQPROPS. When the condition is ABORTED-CHANGE or a subclass, ESEQPROPS-UNTIL returns information about whether or not a change was made by the property applications of the abandoned sequence prior to the property application that was interrupted, enabling useful combinations with ON-CHANGE. Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* add DEFINE-ERROR-RETVAL-CFUN, CHROOT, CLEARENVSean Whitton2021-10-21
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
* release Consfigurator 0.11.0 (-1 to Debian unstable)v0.11.0debian/0.11.0-1archive/debian/0.11.0-1Sean Whitton2021-09-29
| | | | Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-09 21:26:49 +0000