mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-07-31 18:19:40 +00:00
Vinícius Ferrão
f6ba29ef80
The security response headers added to xcat.conf are wrapped in
<IfModule mod_headers.c>, so they only take effect where mod_headers is loaded.
EL loads it by default and the Debian postinst enables it with a2enmod, but SUSE
apache2 does not load it by default, so the headers stayed inactive there. Enable
it in the RPM %post for the apache2 case, guarded so it is a no-op on EL (where
a2enmod is absent and mod_headers is already loaded).
Verified on openSUSE Leap 15.6: mod_headers is off by default, the hardened
config still starts, and after a2enmod the served response carries all four
security headers. The need to load mod_headers on SUSE was identified in the
lenovobuild branch (660df81379 / xcat.conf.apach24.sles), here done via
a2enmod rather than a separate config file.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
294 lines
9.8 KiB
RPMSpec
294 lines
9.8 KiB
RPMSpec
Summary: Metapackage for a common, default xCAT service node setup
|
|
Name: xCATsn
|
|
Version: %{?version:%{version}}%{!?version:%(cat Version)}
|
|
Release: %{?release:%{release}}%{!?release:%(cat Release)}
|
|
Epoch: 4
|
|
License: EPL
|
|
Group: Applications/System
|
|
Vendor: IBM Corp.
|
|
Packager: IBM Corp.
|
|
Distribution: %{?_distribution:%{_distribution}}%{!?_distribution:%{_vendor}}
|
|
Prefix: /opt/xcat
|
|
BuildRoot: /var/tmp/%{name}-%{version}-%{release}-root
|
|
#BuildArch: noarch
|
|
Source1: xcat.conf
|
|
Source2: license.tar.gz
|
|
Source3: xCATSN
|
|
Source4: etc.tar.gz
|
|
Source5: templates.tar.gz
|
|
Source6: xcat.conf.apach24
|
|
Requires: perl-DBD-SQLite
|
|
Requires: xCAT-client = 4:%{version}-%{release}
|
|
Requires: xCAT-server = 4:%{version}-%{release}
|
|
Requires: xCAT-probe = 4:%{version}-%{release}
|
|
|
|
# Match xCAT-genesis-scripts package naming by build architecture.
|
|
%ifarch i386 i586 i686 x86
|
|
Requires: xCAT-genesis-scripts-x86 = 1:%{version}-%{release}
|
|
%endif
|
|
%ifarch x86_64
|
|
Requires: xCAT-genesis-scripts-x86_64 = 1:%{version}-%{release}
|
|
%endif
|
|
%ifarch ppc ppc64 ppc64le
|
|
Requires: xCAT-genesis-scripts-ppc64 = 1:%{version}-%{release}
|
|
%endif
|
|
%ifarch aarch64
|
|
Requires: xCAT-genesis-scripts-aarch64 = 1:%{version}-%{release}
|
|
%endif
|
|
|
|
Conflicts: xCAT
|
|
|
|
%define pcm %(if [ "$pcm" = "1" ];then echo 1; else echo 0; fi)
|
|
%define notpcm %(if [ "$pcm" = "1" ];then echo 0; else echo 1; fi)
|
|
|
|
%ifos linux
|
|
# on RHEL7, need to specify it explicitly
|
|
Requires: net-tools
|
|
Requires: /usr/bin/killall
|
|
Requires: /usr/bin/bc
|
|
# yaboot-xcat is pulled in so any SN can manage ppc nodes
|
|
Requires: httpd nfs-utils nmap bind
|
|
# DHCP backend resolved at INSTALL time (not build time) via an RPM rich
|
|
# dependency, so a single flat xcat-core build is correct on every EL: el10+
|
|
# dropped ISC dhcp from its distro and uses Kea; el8/el9 use ISC dhcpd. SLES
|
|
# has no "system-release" provide, so the condition is false there and it
|
|
# falls to dhcp-server (/usr/sbin/dhcpd), preserving prior behavior.
|
|
# system-release is versioned per release package (el10=10.x, el9=9.x, el8=8.x).
|
|
Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
|
|
Requires: (kea-hooks if (system-release >= 10))
|
|
# On RHEL this pulls in openssh-server, on SLES it pulls in openssh
|
|
Requires: /usr/bin/ssh
|
|
%ifnarch s390x
|
|
Requires: /usr/sbin/in.tftpd
|
|
# Stty is only needed for rcons on ppc64 nodes, but for mixed clusters require it on both x and p
|
|
Requires: perl-IO-Stty
|
|
%endif
|
|
%endif
|
|
|
|
%ifos linux
|
|
Requires: goconserver >= 0.3.3
|
|
%endif
|
|
|
|
%ifarch i386 i586 i686 x86 x86_64
|
|
Requires: xnba-undi
|
|
Requires: syslinux-xcat
|
|
Requires: ipmitool-xcat >= 1.8.17-1
|
|
%endif
|
|
%ifos linux
|
|
%ifarch ppc ppc64 ppc64le
|
|
Requires: ipmitool-xcat >= 1.8.17-1
|
|
%endif
|
|
%endif
|
|
|
|
%description
|
|
xCAT supports management of very large sized cluster by creating a Hierarchical
|
|
Cluster and the concept of xCAT Service Nodes. The xCAT Management Node can
|
|
delegate all management operational needs to the Service Node responsible for a
|
|
set of compute node. xCATsn package provides xCAT service node support.
|
|
|
|
%prep
|
|
%ifos linux
|
|
tar zxf %{SOURCE2}
|
|
tar zxf %{SOURCE4}
|
|
%else
|
|
cp %{SOURCE2} /opt/freeware/src/packages/BUILD
|
|
gunzip -f license.tar.gz
|
|
tar -xf license.tar
|
|
%endif
|
|
|
|
%build
|
|
|
|
%install
|
|
%ifos linux
|
|
mkdir -p $RPM_BUILD_ROOT/etc/xcat/conf.orig
|
|
mkdir -p $RPM_BUILD_ROOT/etc/xcat/rsyslog.conf
|
|
mkdir -p $RPM_BUILD_ROOT/etc/xcat/logrotate.conf
|
|
mkdir -p $RPM_BUILD_ROOT/etc/apache2/conf.d
|
|
mkdir -p $RPM_BUILD_ROOT/etc/httpd/conf.d/
|
|
mkdir -p $RPM_BUILD_ROOT/%{prefix}/share/xcat/
|
|
# cd -
|
|
cp %{SOURCE1} $RPM_BUILD_ROOT/etc/apache2/conf.d/xcat.conf
|
|
cp %{SOURCE1} $RPM_BUILD_ROOT/etc/httpd/conf.d/xcat.conf
|
|
cp %{SOURCE3} $RPM_BUILD_ROOT/etc/xCATSN
|
|
cp %{SOURCE1} $RPM_BUILD_ROOT/etc/xcat/conf.orig/xcat.conf.apach22
|
|
cp %{SOURCE6} $RPM_BUILD_ROOT/etc/xcat/conf.orig/xcat.conf.apach24
|
|
cp -a etc/rsyslog.d/* $RPM_BUILD_ROOT/etc/xcat/rsyslog.conf/
|
|
cp -a etc/logrotate.d/* $RPM_BUILD_ROOT/etc/xcat/logrotate.conf/
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{prefix}/share/doc/packages/xCAT
|
|
cp LICENSE.html $RPM_BUILD_ROOT/%{prefix}/share/doc/packages/xCAT
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{prefix}/share/xcat/
|
|
cd $RPM_BUILD_ROOT/%{prefix}/share/xcat/
|
|
tar zxf %{SOURCE5}
|
|
|
|
%else
|
|
mkdir -p $RPM_BUILD_ROOT/etc/
|
|
mkdir -p $RPM_BUILD_ROOT/opt/xcat/
|
|
cp %{SOURCE3} $RPM_BUILD_ROOT/etc/xCATSN
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{prefix}/share/xcat/
|
|
cd $RPM_BUILD_ROOT/%{prefix}/share/xcat/
|
|
cp %{SOURCE5} $RPM_BUILD_ROOT/%{prefix}/share/xcat
|
|
gunzip -f templates.tar.gz
|
|
tar -xf templates.tar
|
|
rm templates.tar
|
|
|
|
%endif
|
|
|
|
%pre
|
|
# only need to check on AIX
|
|
%ifnos linux
|
|
if [ -x /usr/sbin/emgr ]; then # Check for emgr cmd
|
|
/usr/sbin/emgr -l 2>&1 | grep -i xCAT # Test for any xcat ifixes - msg and exit if found
|
|
if [ $? = 0 ]; then
|
|
echo "Error: One or more xCAT emgr ifixes are installed. You must use the /usr/sbin/emgr command to uninstall each xCAT emgr ifix prior to RPM installation."
|
|
exit 2
|
|
fi
|
|
fi
|
|
%endif
|
|
|
|
%post
|
|
%ifos linux
|
|
#Apply the correct httpd/apache configuration file according to the httpd/apache version
|
|
|
|
compare_version="2.4"
|
|
version=`rpm -qi httpd 2>&1 | grep 'Version' | awk '$NF { print $3 }' | cut -d. -f1,2`
|
|
if [ -n "$version" ]; then
|
|
if (( `bc <<< "$version >= $compare_version"` )); then
|
|
rm -rf /etc/httpd/conf.d/xcat.conf
|
|
cp /etc/xcat/conf.orig/xcat.conf.apach24 /etc/httpd/conf.d/xcat.conf
|
|
fi
|
|
fi
|
|
|
|
version=`rpm -qi apache2 2>&1 | grep '^Version' | awk '$NF { print $3 }' | cut -d. -f1,2`
|
|
if [ -n "$version" ]; then
|
|
if (( `bc <<< "$version >= $compare_version"` )); then
|
|
rm -rf /etc/apache2/conf.d/xcat.conf
|
|
cp /etc/xcat/conf.orig/xcat.conf.apach24 /etc/apache2/conf.d/xcat.conf
|
|
fi
|
|
fi
|
|
|
|
# On SUSE apache2, mod_headers is not loaded by default; enable it so the
|
|
# security response headers in xcat.conf take effect (a no-op where a2enmod
|
|
# is absent, e.g. httpd on EL where mod_headers is already loaded).
|
|
if [ -e /etc/apache2/conf.d/xcat.conf ] && command -v a2enmod >/dev/null 2>&1; then
|
|
a2enmod headers >/dev/null 2>&1 || :
|
|
fi
|
|
|
|
|
|
# Let rsyslogd perform close of any open files
|
|
if [ -e /var/run/rsyslogd.pid ]; then
|
|
kill -HUP $(</var/run/rsyslogd.pid) >/dev/null 2>&1 || :
|
|
elif [ -e /var/run/syslogd.pid ]; then
|
|
kill -HUP $(</var/run/syslogd.pid) >/dev/null 2>&1 || :
|
|
fi
|
|
|
|
%endif
|
|
|
|
# create dir for the current pid and move the original ones from /tmp/xcat to /var/run/xcat
|
|
mkdir -p /var/run/xcat
|
|
if [ -r "/tmp/xcat/installservice.pid" ]; then
|
|
mv /tmp/xcat/installservice.pid /var/run/xcat/installservice.pid
|
|
fi
|
|
if [ -r "/tmp/xcat/udpservice.pid" ]; then
|
|
mv /tmp/xcat/udpservice.pid /var/run/xcat/udpservice.pid
|
|
fi
|
|
if [ -r "/tmp/xcat/mainservice.pid" ]; then
|
|
mv /tmp/xcat/mainservice.pid /var/run/xcat/mainservice.pid
|
|
fi
|
|
|
|
if [ "$1" = "1" ]; then #Only if installing for the first time..
|
|
|
|
# setup sqlite if no other database
|
|
|
|
%ifos linux
|
|
# prevent running it during install into chroot image
|
|
if [ -f "/proc/cmdline" ] && [ "x$(stat -c '%i %d' /)" == "x$(stat -c '%i %d' /proc/1/root/. 2>/dev/null)" ]; then
|
|
if [ ! -s /etc/xcat/cfgloc ]; then # database is sqlite
|
|
$RPM_INSTALL_PREFIX0/sbin/xcatconfig -d
|
|
fi
|
|
fi
|
|
%endif
|
|
|
|
# so conserver will start
|
|
mkdir -p /var/log/consoles
|
|
|
|
# remove any management node file
|
|
if [ -f /etc/xCATMN ]; then
|
|
rm /etc/xCATMN
|
|
fi
|
|
fi
|
|
# for install or upgrade restart the daemon
|
|
%ifos linux
|
|
if [ -e "/etc/redhat-release" ]; then
|
|
apachedaemon='httpd'
|
|
apacheserviceunit='httpd.service'
|
|
else # SuSE
|
|
apachedaemon='apache2'
|
|
fi
|
|
# enable and reload the web server on linux
|
|
[ -e "/etc/init.d/$apachedaemon" ] && chkconfig $apachedaemon on
|
|
[ -e "/usr/lib/systemd/system/$apacheserviceunit" ] && systemctl enable $apacheserviceunit
|
|
# prevent running it during install into chroot image
|
|
if [ -f "/proc/cmdline" ] && [ "x$(stat -c '%i %d' /)" == "x$(stat -c '%i %d' /proc/1/root/. 2>/dev/null)" ]; then
|
|
[ -e "/etc/init.d/$apachedaemon" ] && /etc/init.d/$apachedaemon reload
|
|
[ -e "/usr/lib/systemd/system/$apacheserviceunit" ] && systemctl reload $apacheserviceunit
|
|
fi
|
|
echo "xCATsn is now installed"
|
|
%else
|
|
# start xcatd on AIX
|
|
XCATROOT=$RPM_INSTALL_PREFIX0 $RPM_INSTALL_PREFIX0/sbin/restartxcatd
|
|
echo "xCATsn is now installed"
|
|
|
|
%endif
|
|
|
|
# Run mknb if xCAT-genesis-scripts-x86_64 changed
|
|
%ifos linux
|
|
# prevent running it during install into chroot image and only run it if xCAT-genesis-scripts-x86_64
|
|
# was recently updated.
|
|
if [ -f "/proc/cmdline" ] && [ "x$(stat -c '%i %d' /)" == "x$(stat -c '%i %d' /proc/1/root/. 2>/dev/null)" ]; then
|
|
if [ -f "/etc/xcat/genesis-scripts-updated" ]; then
|
|
rm -f /etc/xcat/genesis-scripts-updated
|
|
# On the SN do not run mknb if we are sharing /tftpboot with the MN
|
|
SHAREDTFTP=`/opt/xcat/sbin/tabdump site | grep sharedtftp | cut -d'"' -f 4`
|
|
if [ "$SHAREDTFTP" != "1" ]; then
|
|
. /etc/profile.d/xcat.sh
|
|
echo Running '"'mknb `uname -m`'"', triggered by the installation/update of xCAT-genesis-scripts-x86_64 ...
|
|
mknb `uname -m`
|
|
fi
|
|
fi
|
|
fi
|
|
%endif
|
|
|
|
%ifos linux
|
|
# xCATsn is installed only on service nodes (it Conflicts: xCAT) and pulls in xCAT-server (xcatd)
|
|
# plus the credentials/cfgloc the servicenode postscript already staged -- so this is the right,
|
|
# autodeclarative place to bring xcatd up on a service node. Guard so it runs only on a real
|
|
# running system (skip the genimage/diskless chroot, where there is no systemd), and start via
|
|
# systemctl: on EL10 the SysV path (/etc/init.d/xcatd) cannot start xcatd.
|
|
if [ -f "/proc/cmdline" ] && [ "x$(stat -c '%i %d' /)" == "x$(stat -c '%i %d' /proc/1/root/. 2>/dev/null)" ]; then
|
|
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
|
|
systemctl restart xcatd.service
|
|
elif [ -x /etc/init.d/xcatd ]; then
|
|
XCATROOT=$RPM_INSTALL_PREFIX0 /etc/init.d/xcatd restart
|
|
fi
|
|
fi
|
|
%endif
|
|
|
|
%clean
|
|
|
|
%files
|
|
%{prefix}
|
|
# one for sles, one for rhel. yes, it's ugly...
|
|
%ifos linux
|
|
/etc/xcat/conf.orig/xcat.conf.apach24
|
|
/etc/xcat/conf.orig/xcat.conf.apach22
|
|
/etc/httpd/conf.d/xcat.conf
|
|
/etc/apache2/conf.d/xcat.conf
|
|
/etc/xcat/logrotate.conf/
|
|
/etc/xcat/rsyslog.conf/
|
|
%endif
|
|
/etc/xCATSN
|
|
%defattr(-,root,root)
|