[PATCH 1/5] sysprep: remove /var/log/audit/audit.log
audit.log is already included in /var/log/audit/*. Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> --- sysprep/sysprep_operation_logfiles.ml | 1 - 1 file changed, 1 deletion(-) diff --git a/sysprep/sysprep_operation_logfiles.ml b/sysprep/sysprep_operation_logfiles.ml index 842b855..cdfe8fc 100644 --- a/sysprep/sysprep_operation_logfiles.ml +++ b/sysprep/sysprep_operation_logfiles.ml @@ -40,7 +40,6 @@ let globs = List.sort compare [ "/var/log/wtmp*"; "/var/log/apache2/*_log"; "/var/log/apache2/*_log-*"; - "/var/log/audit/audit.log"; "/var/log/ntp"; (* logfiles configured by /etc/logrotate.d/* *) -- 1.8.4.27.g0a41de8
Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> --- sysprep/sysprep_operation_logfiles.ml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysprep/sysprep_operation_logfiles.ml b/sysprep/sysprep_operation_logfiles.ml index cdfe8fc..b834d42 100644 --- a/sysprep/sysprep_operation_logfiles.ml +++ b/sysprep/sysprep_operation_logfiles.ml @@ -79,6 +79,9 @@ let globs = List.sort compare [ (* man pages cache *) "/var/cache/man/*"; + + (* log file of sysstat *) + "/var/log/sa/*"; ] let globs_as_pod = String.concat "\n" (List.map ((^) " ") globs) -- 1.8.4.27.g0a41de8
Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> --- sysprep/sysprep_operation_logfiles.ml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysprep/sysprep_operation_logfiles.ml b/sysprep/sysprep_operation_logfiles.ml index b834d42..a8b24f1 100644 --- a/sysprep/sysprep_operation_logfiles.ml +++ b/sysprep/sysprep_operation_logfiles.ml @@ -82,6 +82,9 @@ let globs = List.sort compare [ (* log file of sysstat *) "/var/log/sa/*"; + + (* log file of gdm *) + "/var/log/gdm/*"; ] let globs_as_pod = String.concat "\n" (List.map ((^) " ") globs) -- 1.8.4.27.g0a41de8
Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> --- sysprep/sysprep_operation_logfiles.ml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sysprep/sysprep_operation_logfiles.ml b/sysprep/sysprep_operation_logfiles.ml index a8b24f1..8994af9 100644 --- a/sysprep/sysprep_operation_logfiles.ml +++ b/sysprep/sysprep_operation_logfiles.ml @@ -85,6 +85,9 @@ let globs = List.sort compare [ (* log file of gdm *) "/var/log/gdm/*"; + + (* log file of ntp *) + "/var/log/ntpstats/*"; ] let globs_as_pod = String.concat "\n" (List.map ((^) " ") globs) -- 1.8.4.27.g0a41de8
On Thu, Sep 05, 2013 at 02:57:33PM +0800, Wanlong Gao wrote:
Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> --- sysprep/sysprep_operation_logfiles.ml | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/sysprep/sysprep_operation_logfiles.ml b/sysprep/sysprep_operation_logfiles.ml index a8b24f1..8994af9 100644 --- a/sysprep/sysprep_operation_logfiles.ml +++ b/sysprep/sysprep_operation_logfiles.ml @@ -85,6 +85,9 @@ let globs = List.sort compare [
(* log file of gdm *) "/var/log/gdm/*"; + + (* log file of ntp *) + "/var/log/ntpstats/*"; ] let globs_as_pod = String.concat "\n" (List.map ((^) " ") globs)
Thanks - pushed patches 1-4. See my comments on patch 5. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://people.redhat.com/~rjones/virt-df/
If we do not want to keep the original iptables rules, enable this operation to remove the iptables rules automatically. Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> --- sysprep/Makefile.am | 1 + sysprep/sysprep_operation_iptables.ml | 45 +++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 sysprep/sysprep_operation_iptables.ml diff --git a/sysprep/Makefile.am b/sysprep/Makefile.am index ec6c2bc..3da99c1 100644 --- a/sysprep/Makefile.am +++ b/sysprep/Makefile.am @@ -43,6 +43,7 @@ operations = \ firstboot \ fs_uuids \ hostname \ + iptables \ kerberos_data \ lvm_uuids \ logfiles \ diff --git a/sysprep/sysprep_operation_iptables.ml b/sysprep/sysprep_operation_iptables.ml new file mode 100644 index 0000000..e36a005 --- /dev/null +++ b/sysprep/sysprep_operation_iptables.ml @@ -0,0 +1,45 @@ +(* virt-sysprep + * Copyright (C) 2013 Fujitsu Limited. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + *) + +open Sysprep_operation +open Common_gettext.Gettext + +module G = Guestfs + +let iptables_perform g root = + let typ = g#inspect_get_type root in + if typ <> "windows" then ( + let path = "/etc/sysconfig/iptables" in + (try g#rm path with G.Error _ -> ()); + [] + ) + else [] + +let op = { + defaults with + name = "iptables"; + enabled_by_default = false; + heading = s_"Remove the iptables rules"; + pod_description = Some (s_"\ +The custom iptables rules will be stored in /etc/sysconfig/iptables, +if you do not want to keep these iptables rules, enable this operation +to remove it automatically."); + perform_on_filesystems = Some iptables_perform; +} + +let () = register_operation op -- 1.8.4.27.g0a41de8
On Thu, Sep 05, 2013 at 02:57:34PM +0800, Wanlong Gao wrote:
If we do not want to keep the original iptables rules, enable this operation to remove the iptables rules automatically.
Signed-off-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> --- sysprep/Makefile.am | 1 + sysprep/sysprep_operation_iptables.ml | 45 +++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 sysprep/sysprep_operation_iptables.ml
diff --git a/sysprep/Makefile.am b/sysprep/Makefile.am index ec6c2bc..3da99c1 100644 --- a/sysprep/Makefile.am +++ b/sysprep/Makefile.am @@ -43,6 +43,7 @@ operations = \ firstboot \ fs_uuids \ hostname \ + iptables \ kerberos_data \ lvm_uuids \ logfiles \ diff --git a/sysprep/sysprep_operation_iptables.ml b/sysprep/sysprep_operation_iptables.ml new file mode 100644 index 0000000..e36a005 --- /dev/null +++ b/sysprep/sysprep_operation_iptables.ml @@ -0,0 +1,45 @@ +(* virt-sysprep + * Copyright (C) 2013 Fujitsu Limited. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + *) + +open Sysprep_operation +open Common_gettext.Gettext + +module G = Guestfs + +let iptables_perform g root = + let typ = g#inspect_get_type root in + if typ <> "windows" then ( + let path = "/etc/sysconfig/iptables" in + (try g#rm path with G.Error _ -> ()); + [] + ) + else [] + +let op = { + defaults with + name = "iptables"; + enabled_by_default = false; + heading = s_"Remove the iptables rules"; + pod_description = Some (s_"\ +The custom iptables rules will be stored in /etc/sysconfig/iptables, +if you do not want to keep these iptables rules, enable this operation +to remove it automatically."); + perform_on_filesystems = Some iptables_perform; +} + +let () = register_operation op -- 1.8.4.27.g0a41de8
Doesn't this delete all the firewall rules (not just removing the custom rules)? Of course the other problem (not with this patch) is that distros using firewalld use a completely different method to store custom rules, although it is at least easier to delete custom rules in this case (by removing files the user has created under /etc/firewalld/zones/*.xml). Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Fedora Windows cross-compiler. Compile Windows programs, test, and build Windows installers. Over 100 libraries supported. http://fedoraproject.org/wiki/MinGW
On 09/05/2013 05:18 PM, Richard W.M. Jones wrote:
Doesn't this delete all the firewall rules (not just removing the custom rules)?
I thought that the system will not have a /etc/sysconfig/iptables file by default, it is created by user when he want to enable his custom rules. Right?
Of course the other problem (not with this patch) is that distros using firewalld use a completely different method to store custom rules, although it is at least easier to delete custom rules in this case (by removing files the user has created under /etc/firewalld/zones/*.xml).
Oops, so we can add this, too. right? Thanks, Wanlong Gao
Rich.
On Thu, Sep 05, 2013 at 05:27:50PM +0800, Wanlong Gao wrote:
On 09/05/2013 05:18 PM, Richard W.M. Jones wrote:
Doesn't this delete all the firewall rules (not just removing the custom rules)?
I thought that the system will not have a /etc/sysconfig/iptables file by default, it is created by user when he want to enable his custom rules. Right?
OK.
Of course the other problem (not with this patch) is that distros using firewalld use a completely different method to store custom rules, although it is at least easier to delete custom rules in this case (by removing files the user has created under /etc/firewalld/zones/*.xml).
Oops, so we can add this, too. right?
Yes. As far as I can tell we just need to delete any files matching /etc/firewalld/services/* and /etc/firewalld/zones/* Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming blog: http://rwmj.wordpress.com Fedora now supports 80 OCaml packages (the OPEN alternative to F#)
On 09/05/2013 05:33 PM, Richard W.M. Jones wrote:
On Thu, Sep 05, 2013 at 05:27:50PM +0800, Wanlong Gao wrote:
On 09/05/2013 05:18 PM, Richard W.M. Jones wrote:
Doesn't this delete all the firewall rules (not just removing the custom rules)?
I thought that the system will not have a /etc/sysconfig/iptables file by default, it is created by user when he want to enable his custom rules. Right?
OK.
Of course the other problem (not with this patch) is that distros using firewalld use a completely different method to store custom rules, although it is at least easier to delete custom rules in this case (by removing files the user has created under /etc/firewalld/zones/*.xml).
Oops, so we can add this, too. right?
Yes. As far as I can tell we just need to delete any files matching /etc/firewalld/services/* and /etc/firewalld/zones/*
Yeah, got it, thank you. Regards, Wanlong Gao
Rich.
participants (2)
-
Richard W.M. Jones -
Wanlong Gao