Project

General

Profile

Actions

Bug #2467

closed

Technique Group Management fails to report properly

Added by Nicolas CHARLES over 12 years ago. Updated over 12 years ago.

Status:
Released
Priority:
1 (highest)
Category:
Techniques
Target version:
Severity:
UX impact:
User visibility:
Effort required:
Priority:
Name check:
Fix check:
Regression:

Description

Setting up a Policy Instance based on Group Management, with the variables :
libvirt / root
kvm / root
leads to invalid reports

Francois Bayart and I have noticed that first, the reports are a proper repaired, but the the PT doesn't return any reports, leading to a no answer !

Actions #1

Updated by Nicolas CHARLES over 12 years ago

  • Assignee changed from Jonathan CLARKE to Nicolas CHARLES
A brief study of the PT shows that :
  1. a kept_if_else is used on a command execution, when the command execution can only return repaired or fail
  2. the /etc/group is edited only if the group doesn't exist, or if a mysterious class group_$(index)_created is defined

The success depend on the file edition to be successful, which never happens

Actions #2

Updated by Nicolas CHARLES over 12 years ago

  • Status changed from New to In progress
Actions #3

Updated by Nicolas CHARLES over 12 years ago

Last point, we should not use canonify with logical expression

Actions #4

Updated by Nicolas CHARLES over 12 years ago

  • Status changed from In progress to Pending technical review
  • % Done changed from 0 to 100

Applied in changeset commit:42f1b85e25c8e6ad3d590f8580ac4b50de7a7930.

Actions #5

Updated by Nicolas PERRON over 12 years ago

It seems OK to me ! Thank you Nicolas

Actions #6

Updated by Jonathan CLARKE over 12 years ago

  • Status changed from Pending technical review to Discussion
  • % Done changed from 100 to 50

I'm not convinced about this fix.

There are two operations in the main bundle here: one adds the group if it doesn't exist (addgroup command) and one populates the group with it's members (/etc/group file edit_line).

However, the change introduced by this commit (42f1b85e) modifies the ifvarclass condition of the files promise. As a result, it no longer edits the file after creating the group. This condition should be, in plain English, "only edit the groups file if the group $(name) is already in it". So why not use "ifvarclass => !group_$(index)_absent|group_$(index)_added"?

Actions #7

Updated by Nicolas CHARLES over 12 years ago

Indeed, i was expecting it to converge, but since it's a not, it doesn't make sense....

Actions #8

Updated by Nicolas CHARLES over 12 years ago

  • Status changed from Discussion to Pending technical review
  • % Done changed from 50 to 100

Applied in changeset commit:b93d5a7cac61b65908d3a33dc08f32277973acf3.

Actions #9

Updated by Jonathan CLARKE over 12 years ago

  • Status changed from Pending technical review to Released

OK, this fix looks good to me, thanks.

Actions

Also available in: Atom PDF