From 0626b20e8531b553c4042ebc856a30de96e66201 Mon Sep 17 00:00:00 2001 From: Emiliano Vavassori Date: Fri, 25 Nov 2016 01:37:46 +0100 Subject: [PATCH] Adding local signed fixes. --- .../prereq/files/samba-downgrade_20161124.sh | 42 +++++++++++++++++++ roles/prereq/tasks/fixes.yml | 18 ++++++++ roles/prereq/tasks/main.yml | 6 +++ 3 files changed, 66 insertions(+) create mode 100644 roles/prereq/files/samba-downgrade_20161124.sh create mode 100644 roles/prereq/tasks/fixes.yml diff --git a/roles/prereq/files/samba-downgrade_20161124.sh b/roles/prereq/files/samba-downgrade_20161124.sh new file mode 100644 index 0000000..89216cf --- /dev/null +++ b/roles/prereq/files/samba-downgrade_20161124.sh @@ -0,0 +1,42 @@ +#!/bin/bash + +# Define a fix name. This will be used to check if the fix was already +# applied. +name=samba-downgrade_20161124.sh + +# If already applied, skip +if [[ -f "/var/lib/topolin.ia/fixes/${name}.done" ]]; then + echo "Already fixed with ${name}. Skipping." + exit 0 +fi + +# Make the required modifications. + +export DEBIAN_FRONTEND=noninteractive +apt-get install -q -y --force-yes \ +-o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \ +libsmbclient=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +python-samba=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +samba=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +samba-common=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +samba-common-bin=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +samba-dsdb-modules=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +samba-libs=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +samba-vfs-modules=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +smbclient=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +libnss-winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +libpam-winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +libwbclient0=2:4.3.11+dfsg-0ubuntu0.14.04.1 \ +winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 + +pkglist="libsmbclient python-samba samba-common samba-common-bin samba-dsdb-modules samba-libs samba-vfs-modules smbclient libnss-winbind libpam-winbind libwbclient0" + +for pkg in ${pkglist}; do + apt-mark auto ${pkg} + apt-mark hold ${pkg} +done + +# Once modified the system, ensure to create a check file to skip and not run +# it again if not needed. +mkdir -p /var/lib/topolin.ia/fixes +echo "$(date --iso | tr -d '-')" > /var/lib/topolin.ia/fixes/${name}.done diff --git a/roles/prereq/tasks/fixes.yml b/roles/prereq/tasks/fixes.yml new file mode 100644 index 0000000..815be1b --- /dev/null +++ b/roles/prereq/tasks/fixes.yml @@ -0,0 +1,18 @@ +--- +# Permits to apply per-site signed fixes automatically +# +# Prepare a script file, then crypt it with the Domain Administrator password: +# gpg -r info@bglug.it --symmetric --encrypt script.sh > script.sh.gpg +# +# Put the script within the server directory /var/lib/nethserver/ibay/ks/fixes +# +# List the file within domain.yml: +# apply_fixes: +# - script.sh.gpg +# +# Please see roles/prereq/files/samba-downgrade_20161124.sh as a template. +# + +- name: Applying local signed fixes + shell: "/usr/bin/curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/fixes/{{ item }} | /usr/bin/gpg --passphrase {{ domainadminpasswd }} --decrypt | sudo /bin/bash" + with_items: "{{ ansible_local.domain.apply_fixes|default([]) }}" diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml index 4412571..ab74d55 100644 --- a/roles/prereq/tasks/main.yml +++ b/roles/prereq/tasks/main.yml @@ -10,3 +10,9 @@ tags: - prereq - repos + +- include: fixes.yml + tags: + - prereq + - fixes + when: ansible_local.domain.apply_fixes is defined