xcat.conf was installed as an ordinary payload file and then deleted and
recreated from the Apache-version template in %post. rpm therefore held
no record of what was on disk, and an upgrade replaced an edited file
silently, leaving neither .rpmnew nor .rpmsave. A site that had added
Indexes to the /install block lost it on upgrade and directory listings
began returning 403.
Select the Apache 2.2 or 2.4 configuration at build time, using the same
distribution macros the rest of the spec already relies on, and mark
both /etc/httpd/conf.d/xcat.conf and /etc/apache2/conf.d/xcat.conf as
%config(noreplace). rpm then keeps a modified file and installs the new
vendor version alongside it as xcat.conf.rpmnew.
The old payload recorded the 2.2 file while %post wrote the 2.4 one, so
rpm cannot distinguish a stock file from an edited one across the
transition. A migration compares the active file with the templates the
outgoing package saved under conf.orig and removes it only when it is a
regular file still byte-for-byte identical to one of them. A stock
upgrade then completes without an unnecessary .rpmnew, and anything that
differs is left untouched.
That migration runs in %pretrans, not %pre. rpm fixes each config file's
fate before %pre, so removing the active file there can happen after rpm
has already resolved to write only xcat.conf.rpmnew, leaving the system
with no active configuration at all. %pretrans runs before that decision.
It is an embedded Lua scriptlet because a pre-transaction scriptlet
cannot rely on any dependency being unpacked yet, which also means the
comparison needs no external tool.
bc was needed only by the version check the service-node package no
longer performs.
The Apache directives are unchanged. Document a later-loading conf.d
file as the place for site rules, since that survives upgrades without a
merge.
Promote bind9 from Recommends to Depends on the xcat and xcatsn metapackages. bind9 is
required by makedns, so it must be a hard dependency regardless of the system's APT
recommendation policy -- xCAT manages the cluster DNS through makedns/named, which
makes a DNS server as essential to a management or a service node as the DHCP backend
already declared beside it ("isc-dhcp-server | kea"). As a Recommends it was installed
only while that policy asked for it: an Ubuntu 26.04 management node came up with no
/usr/sbin/named and makedns failing with "failed to start named".
Strip only a trailing third component when deriving the debootstrap suite in the
Ubuntu netboot genimage. The previous s/\.\d+$// also removed the minor from a
two-part osvers, so an initial release with no point-release ISO -- ubuntu26.04, but
equally an initial-release 18.04/20.04/22.04 -- reached debootstrap as a bare major.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
The strip used \b, a regex word boundary, which also exists after
punctuation such as - and . inside a token. An unrelated option ending
in root=, for example foo-root=bar or rd.foo.root=bar, lost its tail
and left garbage like foo- behind.
Require a real command-line token boundary instead: the opening quote
or whitespace. The captured delimiter is kept and the substitution
loops, so consecutive stale root= tokens are still all removed.
The per-node root= was inserted after the opening quote of
KDUMP_COMMANDLINE_APPEND, keeping whatever the line already held. On a
RHEL 7 node configured by the previous script that leaves the legacy
shared-root value in place after the new one, and dracut takes the last
root= on the command line, so the stale shared root kept winning and the
crash initrd still pointed at the export root. Re-running also stacked a
duplicate per-node token each time.
Strip any existing root= token from the line before inserting this
node's own, so re-running enablekdump migrates a legacy config and is
idempotent. The strip anchors on the same opening quote as the insert
and honors word boundaries, so options such as rootflags=nofail from
the stock RHEL 7 file are left alone.
For the RHEL 7/8 NFS path, enablekdump created var/crash and a dummy proc
file at the root of the shared dump export, from every node, at deploy.
It also mounted the export over a general-purpose directory such as /mnt.
kdump checks that the dump path exists on the target when it builds the
initrd, so the path has to exist at deploy time. Create only this node's
own subdirectory, $NODE/var/crash, and point kdump.conf at
path /$NODE/var/crash. Each node now writes only under its own subdir, so
nodes no longer share or collide at the export root, and the dump lands in
the node's directory. The setup mounts a dedicated /mnt/kdumpsetup rather
than a general-purpose directory.
The dummy proc file only ever mattered to the RHEL 7 dracut check, which
wants root= to look like a real filesystem. Keep it for RHEL 7, per node,
and point root= at $KDIP:$KDPATH/$NODE. RHEL 8 no longer writes it.
This design was identified by a lenovobuild change and validated on a
running node: a real kernel panic saved the vmcore under the node's own
directory, and nothing was written to the export root.
The Debian upgrade path sends xcatconfig output to /var/log/xcat/upgrade.log the
same way the rpm one does, so a failed mknb is recorded and never seen.
Apply the same treatment: keep this run's output separately, repeat the failure
on the terminal, and leave the log itself unchanged.
xcatconfig checks what mknb returned and logs the failure, but the upgrade
sends its output to /var/log/xcat/upgrade.log, so the line scrolls past and the
management node is left without a current Genesis image for no visible reason.
Repeat it on the terminal. The output of this run is kept separately from the
log so that a failure recorded by an earlier upgrade cannot raise the warning
again, since the log is appended to.
The otherpkgs postscript ran a bare "yum -y upgrade" after configuring the
xcat-otherpkgs* repositories. That upgrades every installed package from every
enabled repository, so installing a handful of extra packages could also pull
an unrelated distribution update onto the node, at provision time and without
the administrator asking for it.
Scope the upgrade to the repositories the postscript just wrote, which is what
the surrounding code already implies it does. The package install path is left
untouched, so dependencies still resolve against the full repository set.
Only the yum/dnf branch is changed. The zypper and apt branches have the same
unbounded behavior but no equivalent one-flag fix, so they are left alone
rather than half-converted.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The security response headers added to xcat.conf are wrapped in
<IfModule mod_headers.c>, so they only take effect where mod_headers is loaded.
EL loads it by default and the Debian postinst enables it with a2enmod, but SUSE
apache2 does not load it by default, so the headers stayed inactive there. Enable
it in the RPM %post for the apache2 case, guarded so it is a no-op on EL (where
a2enmod is absent and mod_headers is already loaded).
Verified on openSUSE Leap 15.6: mod_headers is off by default, the hardened
config still starts, and after a2enmod the served response carries all four
security headers. The need to load mod_headers on SUSE was identified in the
lenovobuild branch (660df81379 / xcat.conf.apach24.sles), here done via
a2enmod rather than a separate config file.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
Add standard security response headers (X-Frame-Options, X-Content-Type-
Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the
/install and /tftpboot directories, mask the server banner with
"ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from
those file-serving directories. Indexes on /install/postscripts, /install/post
and the doc directory are left intact so directory browsing still works where
xCAT relies on it.
The Header directives are wrapped in <IfModule mod_headers.c> so a server
whose mod_headers is not loaded still starts cleanly instead of failing on an
unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by
default, the xCAT and xCATsn package postinst scripts run "a2enmod headers"
before restarting Apache so the headers take effect there as well; on
RHEL/SLES the module is loaded by default and needs no action.
Recovered from the unmerged lenovobuild branch (originals 7ee0c129, 85c8bc09,
d4d1783a), adapted: the deprecated X-XSS-Protection header and the
mod_allowmethods-dependent AllowMethods directive are omitted, and the Header
directives use "set" rather than "append".
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The postscript rewrites host= in the freshly fetched /etc/xcat/cfgloc to point
at MASTER, discarding the database location the credentials came with. That is
the only record of it when the database does not live on the management node.
Keep it as cfgloc.orig; the existing chmod 600 /etc/xcat/cfgloc* covers it.
Recovered from the unmerged lenovobuild branch (10090a9d). The original also
replaced the atomic write with mv-then-sed, which leaves cfgloc truncated if
sed fails, so the write itself is left alone.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The reboot postscript backgrounds "(sleep 75; reboot) &". On SUSE that can
fire while the installer is still finishing, rebooting the node mid-install.
Use a systemd timer (systemd-run --on-active=90 /sbin/reboot) on SUSE, which
the installer teardown does not race; EL and Ubuntu keep the existing
backgrounded sleep.
Gated on SUSE and the presence of systemd-run, so no other platform changes.
Recovered from the unmerged lenovobuild branch (6785eb3a, 4fe2a72c, ac04f5ad;
net effect, consolidated).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
xCAT and xCATsn hard-required elilo-xcat on every non-s390x install. elilo only
provides the ia64 (Itanium) UEFI loader; modern x86-64 UEFI netboot uses
xnba.efi and aarch64 uses grub2, so the dependency pulls a loader no current
platform needs. Drop the Requires (xnba-undi, which the UEFI path does use, is
kept). elilo-xcat can still be installed by hand for legacy ia64.
An OVMF x86-64 UEFI client netboots through xnba.efi with no elilo involved.
Recovered from the unmerged lenovobuild branch (e53b62e0).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The etc.tar.gz payload is unpacked into the buildroot and the resulting
etc/logrotate.d/xcat inherits whatever mode the build umask produced.
logrotate silently skips (and warns about) config files that are group- or
world-writable, so a loose umask can disable xCAT log rotation entirely.
chmod the file to 644 after extraction so the shipped config is always
honored.
Recovered from the unmerged lenovobuild branch (original cb8d671d).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The RPM %post runs `xcatconfig -u -V >> /var/log/xcat/upgrade.log` with only
stdout redirected, so any errors or warnings the upgrade emits go to the
package manager's output and are lost from the log a later diagnosis relies
on.
Redirect stderr into the same log with 2>&1.
Recovered from the unmerged lenovobuild branch (original 51d87d4d).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The single flat xcat-core repo serves el8/el9/el10 from one build, but two spec
decisions were resolved at BUILD time and so were wrong for the other ELs that
share the same repo.
1. DHCP backend. xCAT.spec and xCATsn.spec selected the dhcp provider with a
build-time %if (rhel >= 10 -> kea, else dhcpd), so an el10 build wrongly
required kea on el8/el9 (and an el8/el9 build wrongly required dhcpd on
el10). Replace it with an install-time RPM rich dependency:
Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
Requires: (kea-hooks if (system-release >= 10))
dnf now resolves it per client: kea on el10+ (which dropped ISC dhcp from the
distro), dhcpd on el8/el9. SLES has no "system-release" provide, so the
condition is false there and it falls back to /usr/sbin/dhcpd, preserving
prior behavior. system-release is versioned per release package
(el10=10.x, el9=9.x, el8=8.x).
2. openssl. Make the xCAT-server openssl Requires uniform across EL (non-SUSE)
instead of el10-only, so the produced package set does not depend on which EL
the build host happened to be.
Also drop xCAT-genesis-base from the default @PACKAGES set in buildrpms.pl: its
initramfs bundles the build-chroot kernel/glibc and is therefore OS- and
arch-dependent, so it cannot ship in the single flat core. It is now built per
target by the xcat-dep pipeline (mockbuild-all.pl, via
`buildrpms.pl --package xCAT-genesis-base`) and ships in xcat-dep/rh<N>. The
explicit `--package xCAT-genesis-base` build path is retained.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat and xcatsn declared a hard dependency on xcat-genesis-scripts-ppc64. In
an amd64-only build that package is never produced, so apt could not satisfy
the dependency and refused to install xcat. Depend only on the amd64
genesis-scripts package.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Port the -r option from the deprecated confignics postscript to
confignetwork. This allows removing network configuration for NICs
that are not defined in xCAT, useful when nodes have extra interfaces
that get DHCP addresses by default.
Safety checks ported from confignics:
- Skip non-ethernet interfaces
- Skip bridge members
- Skip xCAT-defined NICs
- Skip install NIC
- Skip VLAN interfaces
- Skip bonding members (SLAVE/MASTER)
Closes: https://github.com/xcat2/xcat-core/issues/6142
Supersedes: https://github.com/xcat2/xcat-core/pull/7092
Co-Authored-By: Christopher Walker <cjw1006@gmail.com>
NetworkManager auto-generates connection names that can contain spaces
(e.g. "Wired connection 2"). Multiple devices can also share the same
auto-generated name. Both cases cause failures when names are passed
to nmcli in bridge and bond setup paths.
Resolve active connection UUID via nmcli device show (GENERAL.CON-UUID)
instead of by name, which avoids both word-splitting on spaces and
ambiguity when multiple connections share the same name.
Changes:
- Bridge slave setup: resolve UUID via device show instead of by name
- Bond slave setup: same UUID-via-device approach for con down/mod
- Bridge rollback: preserve original xcat-prefixed connection name so
rollback paths restore the correct name instead of a UUID
- Utility functions: quote connection name arguments in
is_nmcli_connection_exist, is_connection_activate_intime, and
wait_nic_connect_intime for defensive correctness
- Add -F flag to grep in is_nmcli_connection_exist for literal matching
- Log both human-readable name and UUID when reusing existing connections
Tested on EL10 host with duplicate "Ethernet connection 1/2" profiles
across multiple NICs — UUID resolution via device returns exactly one
UUID per device regardless of name collisions.
Follows up on #7562 and #7483.
Co-authored-by: OliverTUBAF <86062666+OliverTUBAF@users.noreply.github.com>
NetworkManager can auto-generate connection names with spaces (e.g.
"Wired connection 2"). The bridge slave setup in create_bridge_interface_nmcli
stored this name in a variable that was later expanded unquoted in nmcli
commands, breaking both the initial con mod and all downstream operations
(con up, con delete on rollback). Resolve the connection to its UUID
before use, which is space-safe and valid for all nmcli operations.
Closes: #7483
bool_install_nic on line 99 should be boot_install_nic, matching
the variable used everywhere else in the script. This caused the
SETINSTALLNIC environment variable to have no effect.
Fixes: xcat2/xcat-core#7472
On RHEL 9.x minimal installs, the yum package may not exist as a
separate RPM — only dnf is present with /usr/bin/yum as a symlink.
The previous detection using rpm -q yum would fail, causing hasyum
to remain 0 and skipping repo file creation entirely.
Replace rpm -q based detection with executable checks for /usr/bin/dnf
and /usr/bin/yum. Introduce yumcmd variable to carry the actual command
name through all package operations instead of hardcoding yum.
Fixes: xcat2/xcat-core#7497
Daniel Hilst
Vinícius Ferrão
Vinícius Ferrão
Vinícius Ferrão
Markus Hilger