Anaconda-devel November 2010

anaconda-devel@lists.stg.fedoraproject.org

27 participants
57 discussions

Re: User Experience improvements for Anaconda
by Martin Gracik 08 Dec '10

08 Dec '10

Is it such a big deal to have one normal local user account on your system? Are there any downsides to this? What if the NIS server dies, how will you login in an emergency? I like the idea of not having root, and having only a local user setup with sudo rights in anaconda. Then if I really need the root account, I can do it in command line manually. In my opinion anaconda+firstboot should make life easier for people who don't know much about the system. If you're an advanced user, and really need a root user account, you should already have the knowledge how to create it in command line by yourself. You shouldn't need a GUI wizard for that. -- Martin Gracik ----- "Steve Allen" <allen(a)doobie.itdl.ds.boeing.com> wrote: > M�ir�n Duffy <duffy(a)fedoraproject.org> wrote: > > On Mon, 2010-11-22 at 17:45 +0000, Steve Allen wrote: > > > I already skip the creation of a local account, and set up NIS. > And yes, > > > I do want to set a root password. > > > > I know you already skip it today, but you wouldn't be able to do > that in > > Chris' original proposal I think. I can make sure in the redesign > that > > we handle your case. Thanks! > > And thank you for the consideration. > > Steve > > -- > Steven R. Allen - Linux Admin Weenie > Unix sysadmin: Linux, IRIX, NetBSD, OS X, Solaris, HP/UX, CX/UX > Phone: 206-544-0910 M/S: 4J-06 > > > _______________________________________________ > Anaconda-devel-list mailing list > Anaconda-devel-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/anaconda-devel-list

9 27

Seeding certificates at install time
by Philip Prindeville 04 Dec '10

04 Dec '10

Regarding a posting recently on fedora-devel, I'm considering what would be involved in making the self-signed certificates that various RPM's install as part of their %post/%pre section (openssl, sendmail, mod_ssl, proftpd, cyrus-imapd, etc) be a bit more meaningful than just: # rpm -q --scripts cyrus-imapd preinstall scriptlet (using /bin/sh): ... if [ ! -f /etc/pki/cyrus-imapd/cyrus-imapd.pem ]; then pushd /etc/pki/tls/certs umask 077 /bin/cat<< EOF | make cyrus-imapd.pem -- SomeState SomeCity SomeOrganization SomeOrganizationalUnit localhost.localdomain root(a)localhost.localdomain EOF /bin/chown root.mail cyrus-imapd.pem /bin/chmod 640 cyrus-imapd.pem mv cyrus-imapd.pem /etc/pki/cyrus-imapd/cyrus-imapd.pem popd fi ... and to that end, I wanted to have Anaconda/Kickstart allow one to populate a file such as /etc/certinfo with a few fields: # # Certificate seed data, generated XX/XX/XXXX # C='US' ST='Idaho' L='Boise' O='Redfish Solutions, LLC' OU='' as an example. Then the various scripts could use this as seed data. The other thing that would be useful to have, but this is more of a packaging issue, would be to be able to re-run the %post/%pre scripts (or the idempotent sections of them) that generate certificates or otherwise network identity-derived configuration. In cases where the CN (common name) of a certificate is generated from the hostname, for instance, and the hostname has changed (for instance the machine was rebooted in a production network with a DHCP configured to give it out a hostname). An example of this is in the mod_ssl scripting: # rpm -q --scripts mod_ssl postinstall scriptlet (using /bin/sh): umask 077 if [ ! -f /etc/pki/tls/private/localhost.key ] ; then /usr/bin/openssl genrsa -rand /proc/apm:/proc/cpuinfo:/proc/dma:/proc/filesystems:/proc/interrupts:/proc/ioports:/proc/pci:/proc/rtc:/proc/uptime 1024> /etc/pki/tls/private/localhost.key 2> /dev/null fi FQDN=`hostname` if [ "x${FQDN}" = "x" ]; then FQDN=localhost.localdomain fi if [ ! -f /etc/pki/tls/certs/localhost.crt ] ; then cat<< EOF | /usr/bin/openssl req -new -key /etc/pki/tls/private/localhost.key \ -x509 -days 365 -set_serial $RANDOM \ -out /etc/pki/tls/certs/localhost.crt 2>/dev/null -- SomeState SomeCity SomeOrganization SomeOrganizationalUnit ${FQDN} root@${FQDN} EOF fi So, my question is basically this: what would be involved in modifying Anaconda and Kickstart to include (a) UI support for entering this information in a separate configure screen at install time, or (b) additional options for scripted installs? It shouldn't be too much, right? Thanks, -Philip

2 2

[PATCH][master] Support installing to disk image files.
by David Lehman 02 Dec '10

02 Dec '10

Patches 1, 2, 6, 8, 9, 10, 13, 14, 15, and 16 are just various cleanups. Patch 3 fixes a bug in handling partitions on device-mapper disks. Patches 4, 5, 7, 11, and 12 add support for installing to disk image files. Some known issues: - There's no way to determine product name from liveinst for image installs. - There's no way to ensure the host system can run anaconda correctly. - There's no way to configure network devices for the installed system. - Already-active LUKS devices break devicetree.populate as of now, which renders anaconda-image-cleanup useless if you encrypt any devices in/on your disk images. To create image files you can use dd or qemu-img (raw format). Then, to do an install to the images, you would run something like this (after installing the anaconda rpm): LIVECMD="anaconda --image=/opt/disk1.img --image=/opt/disk2.img -m http://cannonball/install/rawhide/20101110/x86_64/os/" liveinst

4 31

partial offload for bnx2i
by Ales Kozumplik 01 Dec '10

01 Dec '10

Hi, after elaborate experimenting, reading and failing I have a patchset and this is the Anaconda part. Combined with the new libiscsi one can log into the target specified in the firmware of his bnx2i card and utilize its partial offload capabilities for transfers. I'd like to have it in soon, especially the first patch that pulls drivers and the extra daemon into the image so I can verify it works soon. The important part is the libiscsi change but I don't think that anyone is interested in that (or ping me). Ales

6 16

[PATCH] Don't add --enablefingerprint unless fprintd-pam is installed (#656434).
by Chris Lumens 30 Nov '10

30 Nov '10

--- pyanaconda/security.py | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) diff --git a/pyanaconda/security.py b/pyanaconda/security.py index 219d465..198e4d9 100644 --- a/pyanaconda/security.py +++ b/pyanaconda/security.py @@ -32,7 +32,7 @@ selinux_states = { SELINUX_DISABLED: "disabled", class Security: def __init__(self): - self.auth = "--enableshadow --passalgo=sha512 --enablefingerprint" + self.auth = "--enableshadow --passalgo=sha512" if flags.selinux == 1: self.selinux = SELINUX_ENFORCING @@ -59,6 +59,13 @@ class Security: if self.auth.strip() != "": f.write("authconfig %s\n" % self.auth) + def _addFingerprint(self, instPath): + import rpm + + iutil.resetRpmDb(rootPath) + ts = rpm.TransactionSet(rootPath) + return ts.dbMatch('provides', 'fprintd-pam').count() + def write(self, instPath): args = [] @@ -78,6 +85,8 @@ class Security: log.error ("lokkit run failed: %s" % e.strerror) args = ["--update", "--nostart"] + shlex.split(self.auth) + if self._addFingerprint(instPath): + args += ["--enablefingerprint"] try: iutil.execWithRedirect("/usr/sbin/authconfig", args, -- 1.7.1.1

3 2

[rhel6-branch] Focus the window after changing language (#628426)
by Martin Gracik 30 Nov '10

30 Nov '10

We need to call window.present() after changing the install language, so the window is focused in the window manager, and the shortcuts work without needing to click inside the window. --- gui.py | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/gui.py b/gui.py index 992f21f..aef05fa 100755 --- a/gui.py +++ b/gui.py @@ -1306,12 +1306,16 @@ class InstallControlWindow: self.window.destroy() self.window = self.mainxml.get_widget("mainWindow") - + self.createWidgets() self.connectSignals() self.setScreen() self.window.show() + # calling present() will focus the window in the window manager so + # the mnemonics work without additional clicking + self.window.present() + def setLtR(self): ltrrtl = gettext.dgettext("gtk20", "default:LTR") if ltrrtl == "default:RTL": -- 1.7.3.2

2 1

[rhel5-branch] initrd.addrsize fixes
by David Cantrell 30 Nov '10

30 Nov '10

Correctly generate initrd.addrsize for System z. -- David Cantrell <dcantrell(a)redhat.com> Red Hat / Honolulu, HI

2 4

[master] analog: put it under /usr/bin so it's on the path in an installed system.
by Ales Kozumplik 30 Nov '10

30 Nov '10

Related: rhbz#576439 --- anaconda.spec.in | 1 + scripts/Makefile.am | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/anaconda.spec.in b/anaconda.spec.in index 8b8e9ce..055805a 100644 --- a/anaconda.spec.in +++ b/anaconda.spec.in @@ -216,6 +216,7 @@ update-desktop-database &> /dev/null || : %{_libdir}/python*/site-packages/pyanaconda/* %{_libdir}/python*/site-packages/log_picker/* %{_libdir}/anaconda* +%{_bindir}/analog %ifarch %livearches %{_bindir}/liveinst %{_sbindir}/liveinst diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 187d4c6..ac5a080 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -25,8 +25,7 @@ dist_scripts_DATA = mk-images.* pyrc.py dist_noinst_SCRIPTS = getlangnames.py upd-bootimage upd-initrd upd-kernel \ makeupdates -analogdir = $(libexecdir)/$(PACKAGE_NAME) -dist_analog_SCRIPTS = analog +dist_bin_SCRIPTS = analog stage2scriptsdir = $(datadir)/$(PACKAGE_NAME) dist_stage2scripts_SCRIPTS = restart-anaconda -- 1.7.3.2

2 1

Re: User Experience improvements for Anaconda
by Martin Gracik 29 Nov '10

29 Nov '10

On Wed, 2010-11-24 at 07:37 -0800, Steve Allen wrote: > Martin Gracik <mgracik(a)redhat.com> wrote: > > I don't think it works like this all the time. For example, you have > > SELinux enabled by default in Fedora. You also have firewall enabled by > > default. Enabling those tools by default is a policy Fedora is > > enforcing, and you as a user (or organization) can disable it manually. > > This is similar to the root account situation. > > I disagree. They may be on by default, but I can turn them off in the > installer. So they're not enforced. > > Not allowing a root password to be set but rather requiring a user account > to be created, that's enforced. > > Steve > Can we please keep this on the mailing list? I'm not 100% sure now, but I think, in older versions, you could turn them off after boot in firstboot, not during the installation. That's not possible in F14 anymore at all. We could still provide a way of skipping the user creation and setting root password in kickstart installations. This way also vendors preinstalling the OS for their customers could leave the user creation for the actual users in firstboot. My concern now is just the GUI installation. During GUI install, you cannot disable SELinux or firewall. And I think it would be better to have a normal user creation instead of setting root password in the GUI screen as well. -- Martin Gracik <mgracik(a)redhat.com>

3 2

[PATCH rhel6-branch 0/2] Handle broken LVMs
by Brian C. Lane 29 Nov '10

29 Nov '10

Tested this in a virt using reproducer from bug 614812 comment #1 Also ran into new bug 657115 and fixed it with dlehman's help Brian C. Lane (2): Rescan disks when moving back through upgrade check (#614812) Ignore immutable disks in clearPartitions (#657115) iw/autopart_type.py | 8 ++++++++ iw/examine_gui.py | 10 ++++++++++ storage/partitioning.py | 4 ++++ 3 files changed, 22 insertions(+), 0 deletions(-) -- 1.7.3.2

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Anaconda-devel November 2010