5:47 a.m.
Refresh the generated mlcustomize files after libguestfs patches
- generator/customize: document that "--selinux-relabel" checks for
SELinux
- generator/customize: invert SELinux relabeling default
Refer to commit 4e3a44ed1c07 ("common/{mlcustomize,mlv2v}: Add generated
files to git.", 2019-10-14) for background.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1554735
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2075718
Signed-off-by: Laszlo Ersek <lersek(a)redhat.com>
---
mlcustomize/customize_cmdline.mli | 4 ++--
mlcustomize/customize_cmdline.ml | 16 +++++++-------
mlcustomize/customize-options.pod | 23 +++++++++++---------
mlcustomize/customize-synopsis.pod | 2 +-
4 files changed, 24 insertions(+), 21 deletions(-)
diff --git a/mlcustomize/customize_cmdline.mli b/mlcustomize/customize_cmdline.mli
index 14eda49eb1fb..7ee882a6499b 100644
--- a/mlcustomize/customize_cmdline.mli
+++ b/mlcustomize/customize_cmdline.mli
@@ -101,8 +101,8 @@ and flags = {
(* --no-logfile *)
password_crypto : Password.password_crypto option;
(* --password-crypto md5|sha256|sha512 *)
- selinux_relabel : bool;
- (* --selinux-relabel *)
+ no_selinux_relabel : bool;
+ (* --no-selinux-relabel *)
sm_credentials : Subscription_manager.sm_credentials option;
(* --sm-credentials SELECTOR *)
}
diff --git a/mlcustomize/customize_cmdline.ml b/mlcustomize/customize_cmdline.ml
index 9326baa00f75..5d404e84490a 100644
--- a/mlcustomize/customize_cmdline.ml
+++ b/mlcustomize/customize_cmdline.ml
@@ -109,8 +109,8 @@ and flags = {
(* --no-logfile *)
password_crypto : Password.password_crypto option;
(* --password-crypto md5|sha256|sha512 *)
- selinux_relabel : bool;
- (* --selinux-relabel *)
+ no_selinux_relabel : bool;
+ (* --no-selinux-relabel *)
sm_credentials : Subscription_manager.sm_credentials option;
(* --sm-credentials SELECTOR *)
}
@@ -121,7 +121,7 @@ let rec argspec () =
let ops = ref [] in
let scrub_logfile = ref false in
let password_crypto = ref None in
- let selinux_relabel = ref false in
+ let no_selinux_relabel = ref false in
let sm_credentials = ref None in
let rec get_ops () = {
@@ -131,7 +131,7 @@ let rec argspec () =
and get_flags () = {
scrub_logfile = !scrub_logfile;
password_crypto = !password_crypto;
- selinux_relabel = !selinux_relabel;
+ no_selinux_relabel = !no_selinux_relabel;
sm_credentials = !sm_credentials;
}
in
@@ -459,11 +459,11 @@ let rec argspec () =
),
Some "md5|sha256|sha512", "When the virt tools change or set a
password in the guest, this\noption sets the password encryption of that password
to\nC<md5>, C<sha256> or C<sha512>.\n\nC<sha256> and
C<sha512> require glibc E<ge> 2.7 (check crypt(3) inside\nthe
guest).\n\nC<md5> will work with relatively old Linux guests (eg. RHEL 3), but\nis
not secure against modern attacks.\n\nThe default is C<sha512> unless libguestfs
detects an old guest that\ndidn't have support for SHA-512, in which case it will use
C<md5>.\nYou can override libguestfs by specifying this option.\n\nNote this does
not change the default password encryption used\nby the guest when you create new user
accounts inside the guest.\nIf you want to do that, then you should use the
I<--edit> option\nto modify C</etc/sysconfig/authconfig> (Fedora, RHEL)
or\nC</etc/pam.d/common-password> (Debian, Ubuntu).";
(
- [ L"selinux-relabel" ],
- Getopt.Set selinux_relabel,
- s_"Relabel files with correct SELinux labels"
+ [ L"no-selinux-relabel" ],
+ Getopt.Set no_selinux_relabel,
+ s_"Do not relabel files with correct SELinux labels"
),
- None, "Relabel files in the guest so that they have the correct SELinux
label.\n\nThis will attempt to relabel files immediately, but if the operation fails\nthis
will instead touch F</.autorelabel> on the image to schedule a\nrelabel operation
for the next time the image boots.\n\nYou should only use this option for guests which
support SELinux.";
+ None, "Do not attempt to correct the SELinux labels of files in the guest.\n\nIn
such guests that support SELinux, customization automatically\nrelabels files so that they
have the correct SELinux label. (The\nrelabeling is performed immediately, but if the
operation fails,\ncustomization will instead touch F</.autorelabel> on the image
to\nschedule a relabel operation for the next time the image boots.) This\noption
disables the automatic relabeling.\n\nThe option is a no-op for guests that do not support
SELinux.";
(
[ L"sm-credentials" ],
Getopt.String (
diff --git a/mlcustomize/customize-options.pod b/mlcustomize/customize-options.pod
index 71b545da42f9..a83c80a567d0 100644
--- a/mlcustomize/customize-options.pod
+++ b/mlcustomize/customize-options.pod
@@ -206,6 +206,19 @@ the image was built, use this option.
See also: L</LOG FILE>.
+=item B<--no-selinux-relabel>
+
+Do not attempt to correct the SELinux labels of files in the guest.
+
+In such guests that support SELinux, customization automatically
+relabels files so that they have the correct SELinux label. (The
+relabeling is performed immediately, but if the operation fails,
+customization will instead touch F</.autorelabel> on the image to
+schedule a relabel operation for the next time the image boots.) This
+option disables the automatic relabeling.
+
+The option is a no-op for guests that do not support SELinux.
+
=item B<--password> USER:SELECTOR
Set the password for C<USER>. (Note this option does I<not>
@@ -297,16 +310,6 @@ It cannot delete directories, only regular files.
=back
-=item B<--selinux-relabel>
-
-Relabel files in the guest so that they have the correct SELinux label.
-
-This will attempt to relabel files immediately, but if the operation fails
-this will instead touch F</.autorelabel> on the image to schedule a
-relabel operation for the next time the image boots.
-
-You should only use this option for guests which support SELinux.
-
=item B<--sm-attach> SELECTOR
Attach to a pool using C<subscription-manager>.
diff --git a/mlcustomize/customize-synopsis.pod b/mlcustomize/customize-synopsis.pod
index 5f185408978c..252085380a99 100644
--- a/mlcustomize/customize-synopsis.pod
+++ b/mlcustomize/customize-synopsis.pod
@@ -12,5 +12,5 @@
[--truncate-recursive PATH] [--timezone TIMEZONE] [--touch FILE]
[--uninstall PKG,PKG..] [--update] [--upload FILE:DEST]
[--write FILE:CONTENT] [--no-logfile]
- [--password-crypto md5|sha256|sha512] [--selinux-relabel]
+ [--password-crypto md5|sha256|sha512] [--no-selinux-relabel]
[--sm-credentials SELECTOR]
--
2.19.1.3.g30247aa5d201