#1939 Add pungi_buildinstall plugin wrapping runroot Lorax call.
Closed by tkopecek. Opened by jkaluza.
jkaluza/koji pungi-buildinstall  into  master

Download 1939.patch

Current API of runroot plugin allows anyone with "runroot" permission
to run any random command on the builder (although it is run in the
chroot environment). This is often considered as unsafe and possible
security issue and prevents granting "runroot" permissions to other
Koji users which might need it to run Pungi.

In fact, the only runroot task which is really needed by Pungi
is execution of "lorax" command to generate buildinstall deliverables.
Other runroot use-cases can be successfully executed on local machine
without "root" user these days.

In this commit, new pungi_buildinstall plugin is introduced which
wraps "runroot" task in a way that only lorax command can be executed
with only predefined set of arguments (So far example "unsafe" --force
Lorax flag is not supported).

To use this new plugin, only new pungi_buildinstall permission is
required. This new permission can be granted to users who should be able
to execute Pungi compose including the buildinstall phase, but who are
not trusted to be granted full "runroot" permission.

Fixes: #1940

Signed-off-by: Jan Kaluza jkaluza@redhat.com

This has been discussed with @tkopecek who agreed to own this review.

@lsedlar, also CCing you here. Once this gets reviewed, I will add support for this new Koji task to Pungi.

It should be less, it is effectively not blocking anything and immediately spawns runroot. You can set it to 0.1

Is there any lorax argument needed by default? If not, lower it to 2. If yes, mark it properly in "usage"

permission should be checked here

    if not session.hasPerm('admin') or session.hasPerm('pungi_buildinstall'):
        parser.error(_("This action requires pungi_buildinstall or admin privileges"))

unused

unused

unused

This syntax is now working on py26 (use set() instead)

Thanks for the review. I will be AFK for the rest of this week. I'm going to address your comments on Monday.

Also, please reference placeholder issue in commit message via line: "Fixes: https://pagure.io/koji/issue/1940"

rebased onto 0e920ef0679a1dddc3ff646736d3359156e51448

rebased onto b398544906e9c0889a6c83eb5d8e226fa6d70e64

rebased onto 8495d96eaf34d34972a504e50f01ddb9b59aac82

rebased onto a04588fbe53e5e1e2b289972cfecb64d55b11c42

rebased onto 3108f568019a564d13e8af8b1b89f606440ea0fc

@tkopecek, I've added more tests and also fixed the names of some Lorax args.

rebased onto 6115d3d769bc9f01b94b1dceb30afe14d07d792d

rebased onto 60811b4b277e1789991dffab420984a1b3c6b2b1

rebased onto 81289d423d17c9c70b008075dd61f9e8dd309dd4

@tkopecek, I've tested the current code with my Pungi changes and it successfully generated all the deliverables. I think the plugin is working correctly for me now and I treat it as complete for now.

@julian8628 @mikem

might be in stderr?

is this a debug print?

No, this is actually similar to "koji runroot --task-id" - it prints the ID of the executed Koji task.

No, this is actually similar to "koji runroot --task-id" - it prints the ID of the executed Koji task.

ok, could you make it more readable like task ID: xxxx?

:thumbsup: for the code

No, this is actually similar to "koji runroot --task-id" - it prints the ID of the executed Koji task.

ok, could you make it more readable like task ID: xxxx?

I could, but I wanted to keep this output compatible with the koji runroot output if possible. It saves some code in the Pungi. But of course I can change it if you still think so.

No, this is actually similar to "koji runroot --task-id" - it prints the ID of the executed Koji task.
ok, could you make it more readable like task ID: xxxx?

I could, but I wanted to keep this output compatible with the koji runroot output if possible. It saves some code in the Pungi. But of course I can change it if you still think so.

OK, that makes sense

How difficult would it be to make sure the permissions and owner is always updated, no matter whether lorax succeeded or failed?
Currently if lorax fails but manages to create some files already, the user who spawned the task will quite likely not be able to delete the files. (This is an issue with the existing implementation in Pungi. We didn't fix it since it's rather tricky to escape such a command line to pass to runroot.)

@lsedlar, that's good point. I will see what I can do to improve that.

rebased onto 04af95e4981b9e17df86f2fde9b4bd60dfe4bac0

We're going to bundle it only internally. Fedora seems to not use it in near future. If it will, we will bring it back to koji.

Pull-Request has been closed by tkopecek

Metadata