)]}'
{"files/rpms/ironic":[{"author":{"_account_id":7369,"name":"Sergey Skripnick","email":"sskripnick@mirantis.com","username":"redixin"},"change_message_id":"e5b69adce059f6458f5cdc964981d7f6bf0b1a39","unresolved":false,"context_lines":[{"line_number":8,"context_line":"tftp-server"},{"line_number":9,"context_line":"xinetd"},{"line_number":10,"context_line":"policycoreutils-python"},{"line_number":11,"context_line":"net-tools"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAW3%2F%2FztY%3D","line":11,"updated":"2014-04-10 09:25:55.000000000","message":"Why this is needed? Also maybe we need policycoreutils also in files/apts/ironic?","commit_id":"27864fc24ce6bff83264e6290f891a0812b794a0"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"1e9a6a1d6feb025b26b63b8fe28a21b9788caa0e","unresolved":false,"context_lines":[{"line_number":8,"context_line":"tftp-server"},{"line_number":9,"context_line":"xinetd"},{"line_number":10,"context_line":"policycoreutils-python"},{"line_number":11,"context_line":"net-tools"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAW3%2F%2FznI%3D","line":11,"in_reply_to":"AAAAW3%2F%2FztY%3D","updated":"2014-04-10 09:37:03.000000000","message":"honestly, net-tools is not directly required by this patch, it was just skipped from rpms list for whatever reason.\npolicycoreutils-python (yeah, strange name) contains semanage utility. I am not sure about apts, since afaik SELinux is not enabled by default on apt systems and making it work there will require essentially more love.","commit_id":"27864fc24ce6bff83264e6290f891a0812b794a0"}],"lib/ironic":[{"author":{"_account_id":8003,"name":"Aleksandr Gordeev","email":"agordeev@mirantis.com","username":"agordeev"},"change_message_id":"834fc52748b6d271da8aba452d3c55021adaf5fd","unresolved":false,"context_lines":[{"line_number":417,"context_line":"        SSH_SERVICE_NAME\u003dssh"},{"line_number":418,"context_line":"    fi"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    if which selinuxenabled 2\u003e\u00261 \u003e /dev/null \u0026\u0026 selinuxenabled; then"},{"line_number":421,"context_line":"        if which semanage 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":422,"context_line":"            if ! sudo semanage port -l | grep ssh_port_t | tr -s \" \" | cut -d \" \" -f 3 | tr \",\" \"\\n\" | grep $IRONIC_VM_SSH_PORT; then"},{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAWH%2F%2FFkE%3D","line":420,"updated":"2014-03-20 11:35:26.000000000","message":"looks very distro specific. Could you wrap it with something like \"if is_fedora; then\" ?","commit_id":"c9a03b5843eeec55d9a8de656ce25d47b1aeae38"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"552e1c2ecaf5c236b3212393efee4308f20c2724","unresolved":false,"context_lines":[{"line_number":417,"context_line":"        SSH_SERVICE_NAME\u003dssh"},{"line_number":418,"context_line":"    fi"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    if which selinuxenabled 2\u003e\u00261 \u003e /dev/null \u0026\u0026 selinuxenabled; then"},{"line_number":421,"context_line":"        if which semanage 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":422,"context_line":"            if ! sudo semanage port -l | grep ssh_port_t | tr -s \" \" | cut -d \" \" -f 3 | tr \",\" \"\\n\" | grep $IRONIC_VM_SSH_PORT; then"},{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAWH%2F%2FFaI%3D","line":420,"in_reply_to":"AAAAWH%2F%2FFkE%3D","updated":"2014-03-20 11:47:55.000000000","message":"I don\u0027t think so. I expect it to work on any system where SELinux present. Am I wrong?","commit_id":"c9a03b5843eeec55d9a8de656ce25d47b1aeae38"},{"author":{"_account_id":8003,"name":"Aleksandr Gordeev","email":"agordeev@mirantis.com","username":"agordeev"},"change_message_id":"834fc52748b6d271da8aba452d3c55021adaf5fd","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":424,"context_line":"            fi"},{"line_number":425,"context_line":"        else"},{"line_number":426,"context_line":"            echo \"No semanage util, access to SSH port will probably be denied\""},{"line_number":427,"context_line":"        fi"},{"line_number":428,"context_line":"    fi"},{"line_number":429,"context_line":"    restart_service $SSH_SERVICE_NAME"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAWH%2F%2FFgw%3D","line":426,"updated":"2014-03-20 11:35:26.000000000","message":"Is it okay just to echo the warning?\nI think, it might be better to add \n\ndie $LINENO \"message with detailed reason to die\"\n\nto abort the stack.sh execution, because it won\u0027t work correctly if access to ssh port will be denied.","commit_id":"c9a03b5843eeec55d9a8de656ce25d47b1aeae38"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"faca3241c2164a9a0e02537267d6d394a1e4cfd9","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":424,"context_line":"            fi"},{"line_number":425,"context_line":"        else"},{"line_number":426,"context_line":"            echo \"No semanage util, access to SSH port will probably be denied\""},{"line_number":427,"context_line":"        fi"},{"line_number":428,"context_line":"    fi"},{"line_number":429,"context_line":"    restart_service $SSH_SERVICE_NAME"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAWH%2F%2FExk%3D","line":426,"in_reply_to":"AAAAWH%2F%2FE1k%3D","updated":"2014-03-20 13:14:16.000000000","message":"It makes sense, but how I define \"selinuxenabled distros\"? You can install SELinux on Debian (and afaik it\u0027s on roadmap for their next release)","commit_id":"c9a03b5843eeec55d9a8de656ce25d47b1aeae38"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"6c0580ce41021a7dc653e53c828ecc5072292cd4","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":424,"context_line":"            fi"},{"line_number":425,"context_line":"        else"},{"line_number":426,"context_line":"            echo \"No semanage util, access to SSH port will probably be denied\""},{"line_number":427,"context_line":"        fi"},{"line_number":428,"context_line":"    fi"},{"line_number":429,"context_line":"    restart_service $SSH_SERVICE_NAME"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAWH%2F%2FEqM%3D","line":426,"in_reply_to":"AAAAWH%2F%2FEtU%3D","updated":"2014-03-20 13:30:41.000000000","message":"Ok, you convinced me :) I already added for files/rpm. What else distros with SELinux you know?","commit_id":"c9a03b5843eeec55d9a8de656ce25d47b1aeae38"},{"author":{"_account_id":8003,"name":"Aleksandr Gordeev","email":"agordeev@mirantis.com","username":"agordeev"},"change_message_id":"371c5fc4c12d7d295d4c9cc5dff8ebd122872f20","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":424,"context_line":"            fi"},{"line_number":425,"context_line":"        else"},{"line_number":426,"context_line":"            echo \"No semanage util, access to SSH port will probably be denied\""},{"line_number":427,"context_line":"        fi"},{"line_number":428,"context_line":"    fi"},{"line_number":429,"context_line":"    restart_service $SSH_SERVICE_NAME"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAWH%2F%2FEtU%3D","line":426,"in_reply_to":"AAAAWH%2F%2FExk%3D","updated":"2014-03-20 13:25:42.000000000","message":"i meant distro where selinux is enabled by default.","commit_id":"c9a03b5843eeec55d9a8de656ce25d47b1aeae38"},{"author":{"_account_id":8003,"name":"Aleksandr Gordeev","email":"agordeev@mirantis.com","username":"agordeev"},"change_message_id":"6cc9fe9c2a555b756d77f7943c7d229c7658b810","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":424,"context_line":"            fi"},{"line_number":425,"context_line":"        else"},{"line_number":426,"context_line":"            echo \"No semanage util, access to SSH port will probably be denied\""},{"line_number":427,"context_line":"        fi"},{"line_number":428,"context_line":"    fi"},{"line_number":429,"context_line":"    restart_service $SSH_SERVICE_NAME"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAWH%2F%2FE1k%3D","line":426,"in_reply_to":"AAAAWH%2F%2FFZA%3D","updated":"2014-03-20 13:05:52.000000000","message":"I don\u0027t know all the rules, but i think devstack is supposed to be able to finish successfully on any system with default settings. If the system uses SElinux by default and restricts ssh port to standard one by default, the absence of semanage leads to failure on line #432 :)\n\nIt might be even better to add semanage as package dependecy for selinuxenabled distros. Also this should completely eliminate the need of semanage\u0027s presence checking","commit_id":"c9a03b5843eeec55d9a8de656ce25d47b1aeae38"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"552e1c2ecaf5c236b3212393efee4308f20c2724","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":424,"context_line":"            fi"},{"line_number":425,"context_line":"        else"},{"line_number":426,"context_line":"            echo \"No semanage util, access to SSH port will probably be denied\""},{"line_number":427,"context_line":"        fi"},{"line_number":428,"context_line":"    fi"},{"line_number":429,"context_line":"    restart_service $SSH_SERVICE_NAME"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAWH%2F%2FFZA%3D","line":426,"in_reply_to":"AAAAWH%2F%2FFgw%3D","updated":"2014-03-20 11:47:55.000000000","message":"It\u0027s a difficult one for me. Absence of semanage means misconfiguration of files/{rpms,debs,etc}, but it gives no idea if port is enabled. If we turn this to die, we should check it for sure and I\u0027ve no idea how. Your thoughts?","commit_id":"c9a03b5843eeec55d9a8de656ce25d47b1aeae38"},{"author":{"_account_id":7369,"name":"Sergey Skripnick","email":"sskripnick@mirantis.com","username":"redixin"},"change_message_id":"5bab6419d16465cadc761d6938238fcf1f730f7d","unresolved":false,"context_lines":[{"line_number":417,"context_line":"        SSH_SERVICE_NAME\u003dssh"},{"line_number":418,"context_line":"    fi"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    if which selinuxenabled 2\u003e\u00261 \u003e /dev/null \u0026\u0026 selinuxenabled; then"},{"line_number":421,"context_line":"        if which semanage 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":422,"context_line":"            if ! sudo semanage port -l | grep ssh_port_t | tr -s \" \" | cut -d \" \" -f 3 | tr \",\" \"\\n\" | grep $IRONIC_VM_SSH_PORT; then"},{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAW3%2F%2Fz40%3D","line":420,"updated":"2014-04-10 09:23:37.000000000","message":"You can safely use \n\n if selinuxenabled \u003e /dev/null 2\u003e\u00261; then\n\nThe same about semanage","commit_id":"27864fc24ce6bff83264e6290f891a0812b794a0"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"1e9a6a1d6feb025b26b63b8fe28a21b9788caa0e","unresolved":false,"context_lines":[{"line_number":417,"context_line":"        SSH_SERVICE_NAME\u003dssh"},{"line_number":418,"context_line":"    fi"},{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    if which selinuxenabled 2\u003e\u00261 \u003e /dev/null \u0026\u0026 selinuxenabled; then"},{"line_number":421,"context_line":"        if which semanage 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":422,"context_line":"            if ! sudo semanage port -l | grep ssh_port_t | tr -s \" \" | cut -d \" \" -f 3 | tr \",\" \"\\n\" | grep $IRONIC_VM_SSH_PORT; then"},{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAW3%2F%2Fzmk%3D","line":420,"in_reply_to":"AAAAW3%2F%2Fz40%3D","updated":"2014-04-10 09:37:03.000000000","message":"Will fix","commit_id":"27864fc24ce6bff83264e6290f891a0812b794a0"},{"author":{"_account_id":7369,"name":"Sergey Skripnick","email":"sskripnick@mirantis.com","username":"redixin"},"change_message_id":"5bab6419d16465cadc761d6938238fcf1f730f7d","unresolved":false,"context_lines":[{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    if which selinuxenabled 2\u003e\u00261 \u003e /dev/null \u0026\u0026 selinuxenabled; then"},{"line_number":421,"context_line":"        if which semanage 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":422,"context_line":"            if ! sudo semanage port -l | grep ssh_port_t | tr -s \" \" | cut -d \" \" -f 3 | tr \",\" \"\\n\" | grep $IRONIC_VM_SSH_PORT; then"},{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":424,"context_line":"            fi"},{"line_number":425,"context_line":"        else"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAW3%2F%2Fzws%3D","line":422,"updated":"2014-04-10 09:23:37.000000000","message":"If you need to check whether port number is in line, it can be done with only one grep:\n\n if ! sudo semanage port -l grep \"^ssh_port_t.*[^0-9]$IRONIC_VM_SSH_PORT[^0-9]\"; then\n\nThis would match line with \"ssh_port_t\" at the beginning and port number inside. [^0-9] around port number is mandatory, because without it port 222 would match port 2222.","commit_id":"27864fc24ce6bff83264e6290f891a0812b794a0"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"1e9a6a1d6feb025b26b63b8fe28a21b9788caa0e","unresolved":false,"context_lines":[{"line_number":419,"context_line":""},{"line_number":420,"context_line":"    if which selinuxenabled 2\u003e\u00261 \u003e /dev/null \u0026\u0026 selinuxenabled; then"},{"line_number":421,"context_line":"        if which semanage 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":422,"context_line":"            if ! sudo semanage port -l | grep ssh_port_t | tr -s \" \" | cut -d \" \" -f 3 | tr \",\" \"\\n\" | grep $IRONIC_VM_SSH_PORT; then"},{"line_number":423,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":424,"context_line":"            fi"},{"line_number":425,"context_line":"        else"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"AAAAW3%2F%2FzmE%3D","line":422,"in_reply_to":"AAAAW3%2F%2Fzws%3D","updated":"2014-04-10 09:37:03.000000000","message":"Good catch, thank you!","commit_id":"27864fc24ce6bff83264e6290f891a0812b794a0"},{"author":{"_account_id":7369,"name":"Sergey Skripnick","email":"sskripnick@mirantis.com","username":"redixin"},"change_message_id":"de63ceeddd57d92298d035616ec2ed49f421d01a","unresolved":false,"context_lines":[{"line_number":431,"context_line":"    if selinuxenabled 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":432,"context_line":"        if which semanage 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":433,"context_line":"            if ! sudo semanage port -l | grep \"^ssh_port_t.*[^0-9]$IRONIC_VM_SSH_PORT[^0-9]\"; then"},{"line_number":434,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":435,"context_line":"            fi"},{"line_number":436,"context_line":"        else"},{"line_number":437,"context_line":"            die $LINENO \"No semanage util, access to SSH port will be denied\""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"AAAAW3%2F%2Foac%3D","line":434,"updated":"2014-04-11 14:57:34.000000000","message":"What if just try to add this port without checking? I believe it fall with error message like \"port already exists\". Sorry I have no selinux-enabled box to check this.","commit_id":"0cfd25d0b690105bcfdf4126ac63a60268cb180a"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"0730c54793beb98a1858efc1fd624195e27d949e","unresolved":false,"context_lines":[{"line_number":431,"context_line":"    if selinuxenabled 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":432,"context_line":"        if which semanage 2\u003e\u00261 \u003e /dev/null; then"},{"line_number":433,"context_line":"            if ! sudo semanage port -l | grep \"^ssh_port_t.*[^0-9]$IRONIC_VM_SSH_PORT[^0-9]\"; then"},{"line_number":434,"context_line":"                sudo semanage port -a -t ssh_port_t -p tcp $IRONIC_VM_SSH_PORT"},{"line_number":435,"context_line":"            fi"},{"line_number":436,"context_line":"        else"},{"line_number":437,"context_line":"            die $LINENO \"No semanage util, access to SSH port will be denied\""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"AAAAW3%2F%2FoSw%3D","line":434,"in_reply_to":"AAAAW3%2F%2Foac%3D","updated":"2014-04-11 15:13:43.000000000","message":"More precisely: ValueError: Port tcp/2222 already defined","commit_id":"0cfd25d0b690105bcfdf4126ac63a60268cb180a"}]}