ngcpcfg

Commit Graph

Author	SHA1	Message	Date
Mykola Malkov	2344b9e59f	TT#76658 Use temp file to prepare ngcpcfg_perms file Two parallel ngcpcfg processes corrupts this file as they try to write into it simultaneously. As a solution use temporary file to prepare the content of ngcpcfg_perms file and then move it to /etc/ngcp-config/.ngcpcfg_perms. Change-Id: I74baf3ac78a80d96a1b9dfba2be063b7128b1150	6 years ago
Michael Prokop	08f68c829b	MT#22361 Remember file permissions through pre-commit hook + restore-permissions helper script Git doesn't track file permissions (except for the executable flag). For sensitive data (like the 'ssl' directory and file 'constants.yml' with passwords included) we've to prevent non-root users from accessing those files. hooks/pre-commit is inspired and based on the implementation as present in etckeeper (and luckily we're license compatible) and takes care of storing the file permissions inside file /etc/ngcp-config/.ngcpcfg_perms. The restore-permissions helper script takes care of restoring the permissions after cloning the ngcpcfg repository via ngcpcfg itself (being actions decrypt, pull (PRO-only) + initialise (PRO-only)). It can be executed manually as well via `usr/share/ngcp-ngcpcfg/helper/restore-permissions /etc/ngcp-config/` (or wherever the according ngcpcfg repository is placed at). Regarding the commit integration: git(1) itself doesn't track file permissions, so we can't detect changes to file permissions using git itself. Our new pre-commit hook records file permissions via the .ngcpcfg_perms file. Now by just invoking it during 'ngcpcfg commit' time we can ensure that even if there have been any file permission changes in the working directory the file .ngcpcfg_perms is then up2date and committed. JFTR: The solution via the git pre-commit hook ensures that no matter whether you're using 'ngcpcfg commit …' or 'git commit …' you always get the file permissions handled via .ngcpcfg_perms. Now if you want to change file permissions in a clean working directory and commit without using 'ngcpcfg commit' but directly via git itself then you've to use 'git commit --allow-empty ...' and thanks to the pre-commit hook the file .ngcpcfg_perms will still be up2date. Change-Id: I84d608585c626b52112ff649893e232e441c59d8	10 years ago

Author

SHA1

Message

Date

Mykola Malkov

2344b9e59f

TT#76658 Use temp file to prepare ngcpcfg_perms file

Two parallel ngcpcfg processes corrupts this file as they try to write
into it simultaneously.

As a solution use temporary file to prepare the content of ngcpcfg_perms
file and then move it to /etc/ngcp-config/.ngcpcfg_perms.

Change-Id: I74baf3ac78a80d96a1b9dfba2be063b7128b1150

Michael Prokop

08f68c829b

MT#22361 Remember file permissions through pre-commit hook + restore-permissions helper script

Git doesn't track file permissions (except for the executable
flag). For sensitive data (like the 'ssl' directory and file
'constants.yml' with passwords included) we've to prevent
non-root users from accessing those files.

hooks/pre-commit is inspired and based on the implementation
as present in etckeeper (and luckily we're license compatible)
and takes care of storing the file permissions inside file
/etc/ngcp-config/.ngcpcfg_perms.

The restore-permissions helper script takes care of restoring the
permissions after cloning the ngcpcfg repository via ngcpcfg
itself (being actions decrypt, pull (PRO-only) + initialise
(PRO-only)). It can be executed manually as well via
`usr/share/ngcp-ngcpcfg/helper/restore-permissions /etc/ngcp-config/`
(or wherever the according ngcpcfg repository is placed at).

Regarding the commit integration: git(1) itself doesn't track
file permissions, so we can't detect changes to file permissions
using git itself. Our new pre-commit hook records file
permissions via the .ngcpcfg_perms file. Now by just invoking it
during 'ngcpcfg commit' time we can ensure that even if there
have been any file permission changes in the working directory
the file .ngcpcfg_perms is then up2date and committed.

JFTR: The solution via the git pre-commit hook ensures that no
matter whether you're using 'ngcpcfg commit …' or  'git commit …'
you always get the file permissions handled via .ngcpcfg_perms.
Now if you want to change file permissions in a clean working
directory and commit *without* using 'ngcpcfg commit' but
directly via git itself then you've to use 'git commit
--allow-empty ...' and thanks to the pre-commit hook the file
.ngcpcfg_perms will still be up2date.

Change-Id: I84d608585c626b52112ff649893e232e441c59d8

2 Commits (2344b9e59f22485743f6d14fe8e212fd78e3fba8)