packages/aops-ceres
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!149 由于master分支与其它代码差异较大, 手动同步master分支为最新代码

Browse Source 
From: @rabbitali 
Reviewed-by: @zhu-yuncheng 
Signed-off-by: @zhu-yuncheng
This commit is contained in:
openeuler-ci-bot 2023-12-22 03:59:53 +00:00 committed by Gitee
commit 782e4bfb94
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
11 changed files with 413 additions and 2489 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

202
0001-improve-status-judgement-and-hotupgrade-logic.patch Normal file
View File

@ -0,0 +1,202 @@
From 2229dade5b178fa2f6a3b572f110eb4fe6677935 Mon Sep 17 00:00:00 2001
From: wang-guangge <wangguangge@huawei.com>
Date: Mon, 18 Dec 2023 21:59:46 +0800
Subject: [PATCH] improve task execution status code and hotupgrade logic of
reinstalling active/accept hotpatch
---
hotpatch/hotupgrade.py | 69 +++++++++++++++++++++++++++++++-----------
hotpatch/upgrade_en.py | 6 ++--
2 files changed, 54 insertions(+), 21 deletions(-)
diff --git a/hotpatch/hotupgrade.py b/hotpatch/hotupgrade.py
index 5dfee0d..37497cf 100644
--- a/hotpatch/hotupgrade.py
+++ b/hotpatch/hotupgrade.py
@@ -13,6 +13,7 @@
from __future__ import print_function
from time import sleep
+from typing import Tuple
import dnf.base
import dnf.exceptions
@@ -28,6 +29,8 @@ from .upgrade_en import UpgradeEnhanceCommand
from .version import Versions
EMPTY_TAG = "-"
+SUCCEED = 0
+FAIL = 255
@dnf.plugin.register_command
@@ -94,9 +97,14 @@ class HotupgradeCommand(dnf.cli.Command):
logger.info(_('No hot patches marked for install.'))
return
- applied_old_patches = self._get_applied_old_patch(list(available_hp_dict.values()))
- if applied_old_patches:
- self._remove_hot_patches(applied_old_patches)
+ uneffectived_old_patches, effectived_old_patches = self._get_applied_old_patch(list(available_hp_dict.values()))
+ # remove effectived hp from self.hp_list and available_hp_dict
+ effectived_hp_list = [key for key, value in available_hp_dict.items() if value in effectived_old_patches]
+ self.hp_list = [hp for hp in self.hp_list if hp not in effectived_hp_list]
+ available_hp_dict = {key: value for key, value in available_hp_dict.items() if value not in effectived_hp_list}
+
+ if uneffectived_old_patches:
+ self._remove_hot_patches(uneffectived_old_patches)
else:
self.syscare.save()
success = self._install_rpm_pkg(list(available_hp_dict.keys()))
@@ -143,14 +151,24 @@ class HotupgradeCommand(dnf.cli.Command):
if str(ts_item.pkg) == self.kernel_coldpatch:
self.is_kernel_coldpatch_installed = True
- self.keep_hp_operation_atomic(is_all_kernel_hp_actived, target_remove_hp)
+ is_task_success = True
+ is_task_success &= self.keep_hp_operation_atomic(is_all_kernel_hp_actived, target_remove_hp)
if self.is_need_accept_kernel_hp and acceptable_hp:
+ is_accept_success = True
logger.info(_('No available kernel cold patch for takeover, gonna accept available kernel hot patch.'))
for hp in acceptable_hp:
- self._accept_kernel_hp(hp)
+ pkg_info = self._parse_hp_name(hp)
+ if pkg_info['target_name'] != "kernel":
+ continue
+ is_accept_success &= False if self._accept_hp(hp) != SUCCEED else True
+ # if need accept operation but failed, it indicates hotupgrade task failed
+ is_task_success &= is_accept_success
+
+ if not is_task_success:
+ exit(1)
- def keep_hp_operation_atomic(self, is_all_kernel_hp_actived, target_remove_hp):
+ def keep_hp_operation_atomic(self, is_all_kernel_hp_actived, target_remove_hp) -> bool:
"""
Keep hotpatch related operation atomic. Once one kernel hotpatch is not successfully activated or
kabi check fails, uninstall the kernel coldpatch. And unsuccessfully activated hotpatch package
@@ -159,9 +177,13 @@ class HotupgradeCommand(dnf.cli.Command):
Args:
is_all_kernel_hp_actived(bool): are all kernel related hotpatches activated
target_remove_hp(list): target remove hotpatch list
+
+ Returns:
+ bool: if hotupgrade task success
"""
upgrade_en = UpgradeEnhanceCommand(self.cli)
+ is_task_success = True
if self.is_kernel_coldpatch_installed:
if not is_all_kernel_hp_actived:
logger.info(_('Gonna remove %s due to some kernel hotpatch activation failed.'), self.kernel_coldpatch)
@@ -177,8 +199,12 @@ class HotupgradeCommand(dnf.cli.Command):
if target_remove_hp:
logger.info(_('Gonna remove unsuccessfully activated hotpatch rpm.'))
+ # when processing remove operation, do not achieve the expected result of activating hotpatch rpm,
+ # it indicates that the hotupgrade task failed
+ is_task_success &= False
for hotpatch in target_remove_hp:
upgrade_en.remove_rpm(hotpatch)
+ return is_task_success
def _apply_hp(self, hp_full_name):
pkg_info = self._parse_hp_name(hp_full_name)
@@ -264,7 +290,7 @@ class HotupgradeCommand(dnf.cli.Command):
return hp_map
@staticmethod
- def _get_applied_old_patch(available_hp_list: list) -> list:
+ def _get_applied_old_patch(available_hp_list: list) -> Tuple[list, list]:
"""
get targets' applied accumulative hot patches.
User can install and apply multiple sgl (single) hot patches because the rpm name is different,
@@ -273,9 +299,11 @@ class HotupgradeCommand(dnf.cli.Command):
available_hp_list: e.g. ['redis-1.0-1/ACC-1-1', 'redis-1.0-1/SGL_CVE_2022_1-1-1']
Returns:
- list: applied hot patches. e.g. ['redis-1.0-1/ACC-1-1']
+ Tuple[str, str]: a tuple containing two elements (uneffectived hot patches, effectived hot patches).
+ e.g. (['redis-1.0-1/ACC-1-1'], ['redis-1.0-1/SGL_CVE_2022_3047-1-1'])
"""
- hotpatch_set = set()
+ uneffectived_hotpatch_set = set()
+ effectived_hotpatch_set = set()
hps_info = Syscare.list()
for hp_info in hps_info:
# hp_info[Name] is the middle column of syscare list. format: {target_rpm_name}/{hp_name}/{binary_file}
@@ -297,9 +325,12 @@ class HotupgradeCommand(dnf.cli.Command):
hp_info["Status"],
binary_file,
)
- if hotpatch not in hotpatch_set:
- hotpatch_set.add(hotpatch)
- return list(hotpatch_set)
+ if hp_info["Status"] in ["ACTIVED", "ACCEPTED"]:
+ effectived_hotpatch_set.add(hotpatch)
+ continue
+ if hotpatch not in uneffectived_hotpatch_set:
+ uneffectived_hotpatch_set.add(hotpatch)
+ return list(uneffectived_hotpatch_set), list(effectived_hotpatch_set)
def _remove_hot_patches(self, applied_old_patches: list) -> None:
# output = Output(self.base, dnf.conf.Conf())
@@ -548,19 +579,21 @@ class HotupgradeCommand(dnf.cli.Command):
parsed_nevra = parsed_nevras[0]
return parsed_nevra.name, "%s-%s" % (parsed_nevra.version, parsed_nevra.release)
- def _accept_kernel_hp(self, hp_full_name: str):
+ def _accept_hp(self, hp_full_name: str) -> int:
"""
- accept kernel hot patch
+ accept hot patch
Args:
str: hp_full_name: full name of hot patch. e.g. patch-kernel-5.10.0-1-ACC-1-1.x86_64
+
+ Returns:
+ int: status
"""
pkg_info = self._parse_hp_name(hp_full_name)
- if pkg_info['target_name'] != "kernel":
- return
hp_subname = self._get_hp_subname_for_syscare(pkg_info)
output, status = self.syscare.accept(hp_subname)
if status:
- logger.info(_('Accept kernel hot patch failed: %s.'), hp_subname)
+ logger.info(_('Accept hot patch failed: %s.'), hp_subname)
else:
- logger.info(_('Accept kernel hot patch succeed: %s.'), hp_subname)
+ logger.info(_('Accept hot patch succeed: %s.'), hp_subname)
+ return status
diff --git a/hotpatch/upgrade_en.py b/hotpatch/upgrade_en.py
index 3053179..94ba4da 100644
--- a/hotpatch/upgrade_en.py
+++ b/hotpatch/upgrade_en.py
@@ -97,7 +97,10 @@ class UpgradeEnhanceCommand(dnf.cli.Command):
print('Gonna remove %s due to kabi check failed.' % kernel_pkg)
# rebuild rpm database for processing kernel rpm remove operation
self.rebuild_rpm_db()
+ # when processing remove operation, do not achieve the expected result of installing related rpm,
+ # it indicates that the upgrade task failed
self.remove_rpm(kernel_pkg)
+ exit(1)
def remove_rpm(self, pkg: str):
"""
@@ -113,11 +116,8 @@ class UpgradeEnhanceCommand(dnf.cli.Command):
if return_code != SUCCEED:
print('Remove package failed: %s.' % pkg)
print(output)
- exit(1)
else:
print('Remove package succeed: %s.' % pkg)
- # do not achieve the expected result of installing related rpm
- exit(1)
def rebuild_rpm_db(self):
"""
--
2.27.0

628
0001-support-kabi-check.patch
View File

@ -1,628 +0,0 @@
From 0f0cbce6c93b97e312cafead937b46e6b2ceaf51 Mon Sep 17 00:00:00 2001
From: wang-guangge <wangguangge@huawei.com>
Date: Thu, 9 Nov 2023 10:46:33 +0800
Subject: [PATCH] support kabi check
---
ceres/manages/vulnerability_manage.py | 2 +-
hotpatch/hotupgrade.py | 97 +++++-
hotpatch/updateinfo_parse.py | 3 +
hotpatch/upgrade_en.py | 413 ++++++++++++++++++++++++++
4 files changed, 506 insertions(+), 9 deletions(-)
create mode 100644 hotpatch/upgrade_en.py
diff --git a/ceres/manages/vulnerability_manage.py b/ceres/manages/vulnerability_manage.py
index c41a7fa..bad2dee 100644
--- a/ceres/manages/vulnerability_manage.py
+++ b/ceres/manages/vulnerability_manage.py
@@ -620,7 +620,7 @@ class VulnerabilityManage:
Tuple[str, str]
a tuple containing two elements (update result, log).
"""
- code, stdout, stderr = execute_shell_command(f"dnf update {rpm_name} -y")
+ code, stdout, stderr = execute_shell_command(f"dnf upgrade-en {rpm_name} -y")
if code != CommandExitCode.SUCCEED:
return TaskExecuteRes.FAIL, stderr
if "Complete" not in stdout:
diff --git a/hotpatch/hotupgrade.py b/hotpatch/hotupgrade.py
index f61e37f..c508e07 100644
--- a/hotpatch/hotupgrade.py
+++ b/hotpatch/hotupgrade.py
@@ -12,16 +12,14 @@
# ******************************************************************************/
from __future__ import print_function
-from time import sleep
import dnf.base
import dnf.exceptions
import hawkey
+from time import sleep
from dnf.cli import commands
from dnf.cli.option_parser import OptionParser
-
-# from dnf.cli.output import Output
from dnfpluginscore import _, logger
-
+from .upgrade_en import UpgradeEnhanceCommand
from .hot_updateinfo import HotUpdateinfoCommand
from .updateinfo_parse import HotpatchUpdateInfo
from .syscare import Syscare
@@ -37,6 +35,9 @@ class HotupgradeCommand(dnf.cli.Command):
usage = ""
syscare = Syscare()
hp_list = []
+ is_need_accept_kernel_hp = False
+ is_kernel_coldpatch_installed = False
+ kernel_coldpatch = ''
@staticmethod
def set_argparser(parser):
@@ -50,6 +51,13 @@ class HotupgradeCommand(dnf.cli.Command):
parser.add_argument(
"--takeover", default=False, action='store_true', help=_('kernel cold patch takeover operation')
)
+ parser.add_argument(
+ "-f",
+ dest='force',
+ default=False,
+ action='store_true',
+ help=_('force retain kernel rpm package if kernel kabi check fails'),
+ )
def configure(self):
"""Verify that conditions are met so that this command can run.
@@ -104,17 +112,72 @@ class HotupgradeCommand(dnf.cli.Command):
def run_transaction(self) -> None:
"""
- apply hot patches
+ apply hot patches, and process kabi check for kernel package rpm.
Returns:
None
"""
# syscare need a little bit time to process the installed hot patch
sleep(0.5)
+
+ is_all_kernel_hp_actived = True
+ # hotpatch that fail to be activated will be automatically uninstalled
+ target_remove_hp = []
+ acceptable_hp = []
for hp in self.hp_list:
- self._apply_hp(hp)
- if self.opts.takeover and self.is_need_accept_kernel_hp:
+ status = self._apply_hp(hp)
+ if status:
+ target_remove_hp.append(hp)
+ if not hp.startswith('patch-kernel-'):
+ continue
+ if status:
+ is_all_kernel_hp_actived &= False
+ else:
+ is_all_kernel_hp_actived &= True
+ acceptable_hp.append(hp)
+
+ for ts_item in self.base.transaction:
+ if ts_item.action not in dnf.transaction.FORWARD_ACTIONS:
+ continue
+ if str(ts_item.pkg) == self.kernel_coldpatch:
+ self.is_kernel_coldpatch_installed = True
+
+ self.keep_hp_operation_atomic(is_all_kernel_hp_actived, target_remove_hp)
+
+ if self.is_need_accept_kernel_hp and acceptable_hp:
+ logger.info(_('No available kernel cold patch for takeover, gonna accept available kernel hot patch.'))
+ for hp in acceptable_hp:
self._accept_kernel_hp(hp)
+ def keep_hp_operation_atomic(self, is_all_kernel_hp_actived, target_remove_hp):
+ """
+ Keep hotpatch related operation atomic. Once one kernel hotpatch is not successfully activated or
+ kabi check fails, uninstall the kernel coldpatch. And unsuccessfully activated hotpatch package
+ will be removed.
+
+ Args:
+ is_all_kernel_hp_actived(bool): are all kernel related hotpatches activated
+ target_remove_hp(list): target remove hotpatch list
+ """
+ upgrade_en = UpgradeEnhanceCommand(self.cli)
+
+ if self.is_kernel_coldpatch_installed:
+ if not is_all_kernel_hp_actived:
+ logger.info(_('Gonna remove %s due to some kernel hotpatch activation failed.'), self.kernel_coldpatch)
+ upgrade_en.remove_rpm(str(self.kernel_coldpatch))
+ self.is_need_accept_kernel_hp = False
+ # process kabi check
+ elif not upgrade_en.kabi_check(str(self.kernel_coldpatch)) and not self.opts.force:
+ logger.info(_('Gonna remove %s due to Kabi check failed.'), self.kernel_coldpatch)
+ # rebuild rpm database for processing kernel rpm remove operation
+ upgrade_en.rebuild_rpm_db()
+ upgrade_en.remove_rpm(str(self.kernel_coldpatch))
+ self.is_need_accept_kernel_hp = True
+
+ if target_remove_hp:
+ logger.info(_('Gonna remove unsuccessfully activated hotpatch rpm.'))
+ for hotpatch in target_remove_hp:
+ upgrade_en.remove_rpm(hotpatch)
+
def _apply_hp(self, hp_full_name):
pkg_info = self._parse_hp_name(hp_full_name)
hp_subname = self._get_hp_subname_for_syscare(pkg_info)
@@ -123,6 +186,7 @@ class HotupgradeCommand(dnf.cli.Command):
logger.info(_('Apply hot patch failed: %s.'), hp_subname)
else:
logger.info(_('Apply hot patch succeed: %s.'), hp_subname)
+ return status
@staticmethod
def _get_hp_subname_for_syscare(pkg_info: dict) -> str:
@@ -394,9 +458,11 @@ class HotupgradeCommand(dnf.cli.Command):
"""
process takeover operation.
"""
+ if not self.get_kernel_hp_list():
+ return
kernel_coldpatch = self.get_target_installed_kernel_coldpatch_of_hotpatch()
- self.is_need_accept_kernel_hp = False
if kernel_coldpatch:
+ self.kernel_coldpatch = kernel_coldpatch
logger.info(_("Gonna takeover kernel cold patch: ['%s']" % kernel_coldpatch))
success = self._install_rpm_pkg([kernel_coldpatch])
if success:
@@ -412,6 +478,21 @@ class HotupgradeCommand(dnf.cli.Command):
)
return
+ def get_kernel_hp_list(self) -> list:
+ """
+ Get kernel hp list from self.hp_list.
+
+ Returns:
+ list: kernel hp list
+ e.g.
+ ['patch-kernel-5.10.0-153.12.0.92.oe2203sp2-ACC-1-1.x86_64']
+ """
+ kernel_hp_list = []
+ for hp in self.hp_list:
+ if hp.startswith('patch-kernel-'):
+ kernel_hp_list.append(hp)
+ return kernel_hp_list
+
def get_target_installed_kernel_coldpatch_of_hotpatch(self) -> str:
"""
get the highest kernel cold patch of hot patch in "dnf hot-updateinfo list cves", if the corresponding
diff --git a/hotpatch/updateinfo_parse.py b/hotpatch/updateinfo_parse.py
index 4760378..fc39d48 100644
--- a/hotpatch/updateinfo_parse.py
+++ b/hotpatch/updateinfo_parse.py
@@ -322,6 +322,9 @@ class HotpatchUpdateInfo(object):
cmd = ["uname", "-r"]
kernel_version = ''
kernel_version, return_code = cmd_output(cmd)
+ # 'uname -r' show the kernel version-release.arch of the current system
+ # [root@openEuler hotpatch]# uname -r
+ # 5.10.0-136.12.0.86.oe2203sp1.x86_64
if return_code != SUCCEED:
return kernel_version
kernel_version = kernel_version.split('\n')[0]
diff --git a/hotpatch/upgrade_en.py b/hotpatch/upgrade_en.py
new file mode 100644
index 0000000..266bcae
--- /dev/null
+++ b/hotpatch/upgrade_en.py
@@ -0,0 +1,413 @@
+#!/usr/bin/python3
+# ******************************************************************************
+# Copyright (c) Huawei Technologies Co., Ltd. 2023-2023. All rights reserved.
+# licensed under the Mulan PSL v2.
+# You can use this software according to the terms and conditions of the Mulan PSL v2.
+# You may obtain a copy of Mulan PSL v2 at:
+# http://license.coscl.org.cn/MulanPSL2
+# THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT, MERCHANTABILITY OR FIT FOR A PARTICULAR
+# PURPOSE.
+# See the Mulan PSL v2 for more details.
+# ******************************************************************************/
+import dnf
+import gzip
+import subprocess
+from dnfpluginscore import _
+from dnf.cli import commands
+from dnf.cli.commands.upgrade import UpgradeCommand
+from dnf.cli.option_parser import OptionParser
+
+SUCCEED = 0
+FAIL = 255
+
+
+def cmd_output(cmd):
+ try:
+ result = subprocess.Popen(cmd, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+ result.wait()
+ return result.stdout.read().decode('utf-8'), result.returncode
+ except Exception as e:
+ print("error: ", e)
+ return str(e), FAIL
+
+
+@dnf.plugin.register_command
+class UpgradeEnhanceCommand(dnf.cli.Command):
+ SYMVERS_FILE = "/boot/symvers-%s.gz"
+
+ aliases = ['upgrade-en']
+ summary = _(
+ 'upgrade with KABI(Kernel Application Binary Interface) check. If the loaded kernel modules \
+ have KABI compatibility with the new version kernel rpm, the kernel modules can be installed \
+ and used in the new version kernel without recompling.'
+ )
+
+ @staticmethod
+ def set_argparser(parser):
+ parser.add_argument(
+ 'packages',
+ nargs='*',
+ help=_('Package to upgrade'),
+ action=OptionParser.ParseSpecGroupFileCallback,
+ metavar=_('PACKAGE'),
+ )
+ parser.add_argument(
+ "-f",
+ dest='force',
+ default=False,
+ action='store_true',
+ help=_('force retain kernel rpm package if kernel kabi check fails'),
+ )
+
+ def configure(self):
+ """Verify that conditions are met so that this command can run.
+
+ These include that there are enabled repositories with gpg
+ keys, and that this command is being run by the root user.
+ """
+ demands = self.cli.demands
+ demands.sack_activation = True
+ demands.available_repos = True
+ demands.resolving = True
+ demands.root_user = True
+ commands._checkGPGKey(self.base, self.cli)
+ if not self.opts.filenames:
+ commands._checkEnabledRepo(self.base)
+ self.upgrade_minimal = None
+ self.all_security = None
+ self.skipped_grp_specs = None
+
+ def run(self):
+ self.upgrade()
+
+ def run_transaction(self):
+ """
+ Process kabi check for kernel rpm package installed this time. If the kernel rpm pakcgae fails kabi check,
+ uninstall it.
+ """
+ for ts_item in self.base.transaction:
+ if ts_item.action not in dnf.transaction.FORWARD_ACTIONS:
+ continue
+ if ts_item.pkg.name == 'kernel':
+ kernel_pkg = str(ts_item.pkg)
+ success = self.kabi_check(kernel_pkg)
+ if not success and not self.opts.force:
+ print('Gonna remove %s due to kabi check failed.' % kernel_pkg)
+ # rebuild rpm database for processing kernel rpm remove operation
+ self.rebuild_rpm_db()
+ self.remove_rpm(kernel_pkg)
+
+ def remove_rpm(self, pkg: str):
+ """
+ Remove rpm package via command line.
+
+ Args:
+ pkg(str): package name
+ e.g.
+ kernel-5.10.0-153.18.0.94.oe2203sp2.x86_64
+ """
+ remove_cmd = ["dnf", "remove", pkg, "-y"]
+ output, return_code = cmd_output(remove_cmd)
+ if return_code != SUCCEED:
+ print('Remove package failed: %s.' % pkg)
+ exit(1)
+ else:
+ print('Remove package succeed: %s.' % pkg)
+ # do not achieve the expected result of installing related kernel rpm
+ exit(1)
+
+ def rebuild_rpm_db(self):
+ """
+ Rebuild rpm database for processing kernel rpm remove operation.
+ """
+ rebuilddb_cmd = ["rpm", "--rebuilddb"]
+ output, return_code = cmd_output(rebuilddb_cmd)
+ if return_code != SUCCEED:
+ print('Rebuild rpm database failed.')
+ else:
+ print('Rebuild rpm database succeed.')
+
+ def kabi_check(self, pkg: str) -> bool:
+ """
+ Process kabi check after upgrading kernel rpm.
+
+ Args:
+ pkg(str): package name
+ e.g.
+ kernel-5.10.0-153.18.0.94.oe2203sp2.x86_64
+
+ Returns:
+ bool: kabi check result
+ """
+ print("Kabi check for %s:" % pkg)
+ # version-release.arch
+ evra = pkg.split("-", 1)[1]
+ symvers_file = self.SYMVERS_FILE % (evra)
+
+ target_symvers_symbol_crc_mapping, return_code = self.get_target_symvers_symbol_crc_mapping(symvers_file)
+ if return_code != SUCCEED:
+ print('[Fail] Cannot find the symvers file of %s.', pkg)
+ return False
+ module_actual_symbol_crc_mapping = self.get_module_actual_symbol_crc_mapping()
+
+ module_different_symbol_crc_mapping = self.compare_actual_and_target_symvers_symbol_crc_mapping(
+ module_actual_symbol_crc_mapping, target_symvers_symbol_crc_mapping
+ )
+
+ sum_module_num = len(module_actual_symbol_crc_mapping)
+ fail_module_num = len(module_different_symbol_crc_mapping)
+ pass_module_num = sum_module_num - fail_module_num
+
+ reminder_statement = "Here are %s loaded kernel modules in this system, %s pass, %s fail." % (
+ sum_module_num,
+ pass_module_num,
+ fail_module_num,
+ )
+
+ if fail_module_num > 0:
+ print('[Fail] %s' % reminder_statement)
+ self.output_symbol_crc_difference_report(module_different_symbol_crc_mapping)
+ return False
+
+ print('[Success] %s' % reminder_statement)
+ return True
+
+ def output_symbol_crc_difference_report(self, module_different_symbol_crc_mapping: dict):
+ """
+ Format the output for symbol crc difference report.
+ The output is as follows:
+
+ Failed modules are as follows:
+ No. Module Difference
+ 1 upatch ipv6_chk_custom_prefix : 0x0c994af2 != 0x0c994af3
+ pcmcia_reset_card : 0xe9bed965 != null
+ 2 crct10dif_pclmul crypto_unregister_shash: 0x60f5b0b7 != 0x0c994af3
+ __fentry__ : 0xbdfb6dbb != null
+ """
+ print('Failed modules are as follows:')
+
+ title = ['No.', 'Module', 'Difference']
+ # column width
+ sequence_width = len(title[0])
+ module_width = len(title[1])
+ symbol_width = crc_info_width = 0
+
+ for seq, module_name in enumerate(module_different_symbol_crc_mapping):
+ # the sequence starts from 1
+ seq = seq + 1
+ sequence_width = max(sequence_width, len(str(seq)))
+ different_symbol_crc_mapping = module_different_symbol_crc_mapping[module_name]
+ module_width = max(module_width, len(module_name))
+ for symbol, crc_list in different_symbol_crc_mapping.items():
+ symbol_width = max(symbol_width, len(symbol))
+ crc_info = "%s != %s" % (crc_list[0], crc_list[1])
+ crc_info_width = max(crc_info_width, len(crc_info))
+
+ # print title
+ print('%-*s %-*s %s' % (sequence_width, title[0], module_width, title[1], title[2]))
+
+ for seq, module_name in enumerate(module_different_symbol_crc_mapping):
+ seq = seq + 1
+ print('%-*s %-*s' % (sequence_width, seq, module_width, module_name), end='')
+ different_symbol_crc_mapping = module_different_symbol_crc_mapping[module_name]
+ is_first_symbol = True
+ for symbol, crc_list in different_symbol_crc_mapping.items():
+ crc_info = "%s != %s" % (crc_list[0], crc_list[1])
+ if is_first_symbol:
+ print(' %-*s: %s' % (symbol_width, symbol, crc_info), end='')
+ is_first_symbol = False
+ else:
+ print(
+ ' %-*s %-*s: %s' % (sequence_width + module_width, "", symbol_width, symbol, crc_info), end=''
+ )
+ print('')
+
+ def compare_actual_and_target_symvers_symbol_crc_mapping(
+ self, module_actual_symbol_crc_mapping: dict, target_symvers_symbol_crc_mapping: dict
+ ) -> dict:
+ """
+ Compare the actual symbol crc mapping with the target symvers symbol crc mapping.
+
+ Args:
+ module_actual_symbol_crc_mapping(dict): module actual symbol crc mapping
+ e.g.
+ {
+ 'upatch': {
+ 'ipv6_chk_custom_prefix': '0x0c994af3',
+ 'pcmcia_reset_card': '0xe9bed965',
+ }
+ }
+
+ target_symvers_symbol_crc_mapping(dict): target symvers symbol crc mapping
+ e.g.
+ {
+ 'ipv6_chk_custom_prefix': '0x0c994af2',
+ 'pcmcia_reset_card': '0xe9bed965',
+ }
+
+ Returns:
+ dict: module different symbol crc mapping
+ e.g.
+ {
+ 'upatch': {
+ 'ipv6_chk_custom_prefix': ['0x0c994af3', '0x0c994af2'].
+ }
+ }
+ """
+ module_different_symbol_crc_mapping = dict()
+ for module_name, actual_symbol_crc_mapping in module_actual_symbol_crc_mapping.items():
+ different_symbol_crc_mapping = dict()
+ for actual_symbol, actual_crc in actual_symbol_crc_mapping.items():
+ if actual_symbol not in target_symvers_symbol_crc_mapping:
+ continue
+ elif target_symvers_symbol_crc_mapping[actual_symbol] != actual_symbol_crc_mapping[actual_symbol]:
+ different_symbol_crc_mapping[actual_symbol] = [
+ actual_crc,
+ target_symvers_symbol_crc_mapping[actual_symbol],
+ ]
+ if not different_symbol_crc_mapping:
+ continue
+ module_different_symbol_crc_mapping[module_name] = different_symbol_crc_mapping
+ return module_different_symbol_crc_mapping
+
+ def get_module_actual_symbol_crc_mapping(self) -> dict:
+ """
+ Get the module actual symbol crc mapping of the driver modules currently being loaded in the system.
+
+ Returns:
+ dict: module actual symbol crc mapping
+ e.g.
+ {
+ 'upatch': {
+ 'ipv6_chk_custom_prefix': '0x0c994af3',
+ 'pcmcia_reset_card': '0xe9bed965',
+ }
+ }
+ """
+ module_actual_symbol_crc_mapping = dict()
+ lsmod_cmd = ["lsmod"]
+ # 'lsmod' shows all modules loaded in the system
+ # e.g.
+ # [root@openEuler ~]# lsmod
+ # Module Size Used by
+ # upatch 53248 0
+ # nft_fib_inet 16384 1
+ # nft_fib_ipv4 16384 1 nft_fib_inet
+ list_output, return_code = cmd_output(lsmod_cmd)
+ if return_code != SUCCEED:
+ return module_actual_symbol_crc_mapping
+
+ content = list_output.split('\n')
+ for line in content[1:]:
+ if not line:
+ continue
+ module_name = line.split()[0]
+ modinfo_cmd = ['modinfo', module_name, '-n']
+ # 'modinfo module_name -n' shows module path information
+ # e.g.
+ # [root@openEuler ~]# modinfo upatch -n
+ # /lib/modules/5.10.0-153.12.0.92.oe2203sp2.x86_64/weak-updates/syscare/upatch.ko
+ module_path_output, return_code = cmd_output(modinfo_cmd)
+ if return_code != SUCCEED:
+ continue
+
+ module_path = module_path_output.split('\n')[0]
+ actual_symbol_crc_mapping, return_code = self.get_actual_symbol_crc_mapping(module_path)
+ if return_code != SUCCEED:
+ continue
+
+ module_actual_symbol_crc_mapping[module_name] = actual_symbol_crc_mapping
+ return module_actual_symbol_crc_mapping
+
+ def get_actual_symbol_crc_mapping(self, module_path: str) -> (dict, int):
+ """
+ Get actual symbol crc mapping for specific module.
+
+ Args:
+ module_path(str): loaded module path
+
+ Returns:
+ dict, bool: actual symbol crc mapping, return code
+ """
+ actual_symbol_crc_mapping = dict()
+ modprobe_cmd = ['modprobe', '--dump', module_path]
+ # 'modprobe --dump module_path' shows module related kabi information
+ # e.g.
+ # [root@openEuler ~]# modprobe --dump \
+ # /lib/modules/5.10.0-153.12.0.92.oe2203sp2.x86_64/weak-updates/syscare/upatch.ko
+ # 0xe32130cf module_layout
+ # 0x9c4befaf kmalloc_caches
+ # 0xeb233a45 __kmalloc
+ # 0xd6ee688f vmalloc
+ # 0x349cba85 strchr
+ # 0x754d539c strlen
+ crc_symbol_output_lines, return_code = cmd_output(modprobe_cmd)
+ if return_code != SUCCEED:
+ return actual_symbol_crc_mapping, return_code
+
+ crc_symbol_output = crc_symbol_output_lines.split('\n')
+ for crc_symbol_line in crc_symbol_output:
+ if not crc_symbol_line:
+ continue
+ crc_symbol_line = crc_symbol_line.split()
+ crc, symbol = crc_symbol_line[0], crc_symbol_line[1]
+ actual_symbol_crc_mapping[symbol] = crc
+ return actual_symbol_crc_mapping, return_code
+
+ def get_target_symvers_symbol_crc_mapping(self, symvers_file: str) -> (dict, int):
+ """
+ Get target symbol crc mapping from symvers file of kernel rpm package. The symvers file content is
+ as follows(e.g.):
+
+ 0x0c994af3 ipv6_chk_custom_prefix vmlinux EXPORT_SYMBOL
+ 0xe9bed965 pcmcia_reset_card vmlinux EXPORT_SYMBOL
+ 0x55417264 unregister_vt_notifier vmlinux EXPORT_SYMBOL_GPL
+ 0x8c8905c0 set_anon_super vmlinux EXPORT_SYMBOL
+ 0x3ba051a9 __cleancache_invalidate_page vmlinux EXPORT_SYMBOL
+
+ the first column is crc(Cyclic Redundancy Check), and the second column is symbol.
+
+ Args:
+ symvers_file(str): symvers file path
+
+ Returns:
+ dict, int: target symvers symbol crc mapping, return_code
+ e.g.
+ {
+ 'ipv6_chk_custom_prefix': '0x0c994af3',
+ 'pcmcia_reset_card': '0xe9bed965',
+ },
+ SUCCEED
+ """
+ symvers_symbol_crc_mapping = dict()
+ try:
+ content = gzip.open(symvers_file, 'rb')
+ except FileNotFoundError as e:
+ print("error: ", e)
+ return symvers_symbol_crc_mapping, FAIL
+
+ for line in content.readlines():
+ line = line.decode()
+ line = line.split()
+ crc, symbol = line[0], line[1]
+ symvers_symbol_crc_mapping[symbol] = crc
+ content.close()
+ return symvers_symbol_crc_mapping, SUCCEED
+
+ def upgrade(self):
+ """
+ Use UpgradeCommand to process the upgrade operation.
+ """
+ upgrade = UpgradeCommand(self.cli)
+ upgrade.upgrade_minimal = self.upgrade_minimal
+ upgrade.opts = self.opts
+ upgrade.opts.filenames = self.opts.filenames
+ upgrade.opts.pkg_specs = self.opts.pkg_specs
+ upgrade.opts.grp_specs = self.opts.grp_specs
+
+ upgrade.upgrade_minimal = None
+ upgrade.all_security = None
+ upgrade.skipped_grp_specs = None
+
+ upgrade.run()
--
2.27.0

81
0002-modify-re-of-kernel-filter.patch
View File

@ -1,81 +0,0 @@
From 831aca01a20fcd67b1d6ff604a0334aaa419efd5 Mon Sep 17 00:00:00 2001
From: gongzt <gong_zhengtang@163.com>
Date: Sat, 11 Nov 2023 17:47:25 +0800
Subject: Modify the regular expression of kernel filter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
ceres/manages/vulnerability_manage.py | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/ceres/manages/vulnerability_manage.py b/ceres/manages/vulnerability_manage.py
index c41a7fa..39f475d 100644
--- a/ceres/manages/vulnerability_manage.py
+++ b/ceres/manages/vulnerability_manage.py
@@ -166,7 +166,7 @@ class VulnerabilityManage:
return rpm_info
for line in stdout.splitlines():
- rpm_name, new_rpm_info = line.split(":",1)
+ rpm_name, new_rpm_info = line.split(":", 1)
old_rpm_info = rpm_info.get(rpm_name, "")
rpm_info[rpm_name] = new_rpm_info if new_rpm_info > old_rpm_info else old_rpm_info
LOGGER.debug("query installed rpm package info succeed!")
@@ -200,7 +200,7 @@ class VulnerabilityManage:
# ("kernel", "x86_64.", "5.10.0-60.105.0.132.oe2203"),
# ("kernel-debuginfo", "x86_64", "5.10.0-60.105.0.132.oe2203")
# ]
- rpm_info = re.findall("^(kernel\S*)\.([a-z468_]+)\s+(\S+)", stdout, re.MULTILINE)
+ rpm_info = re.findall("^(kernel)\.([a-z468_]+)\s+(\S+)", stdout, re.MULTILINE)
if not rpm_info:
return result
@@ -243,7 +243,7 @@ class VulnerabilityManage:
# ("CVE-2021-43976", "Important/Sec.", "kernel-4.19.90-2201.1.0.0132.oe1.x86_64"),
# ("CVE-2021-0941", "Important/Sec.", "kernel-4.19.90-2201.1.0.0132.oe1.x86_64")
# ]
- all_cve_info = re.findall(r"(CVE-\d{4}-\d+)\s+([\w+/.]+)\s+(kernel\S+)", stdout)
+ all_cve_info = re.findall(r"(CVE-\d{4}-\d+)\s+([\w+/.]+)\s+(kernel-\d\S+)", stdout)
if not all_cve_info:
return unfixed_cves
@@ -306,7 +306,7 @@ class VulnerabilityManage:
# ("CVE-2023-1513", "Important/Sec.", "kernel-4.19.90-2304.1.0.0196.oe1.x86_64", "patch-kernel-4.19.90-2112.."),
# ("CVE-2021-xxxx", "Important/Sec.", "-", "patch-redis-6.2.5-1-SGL_CVE_2023_1111_CVE_2023_1112-1-1.x86_64")
# ]
- all_cve_info = re.findall(r"(CVE-\d{4}-\d+)\s+([\w+/.]+)\s+(kernel\S+|-)\s+(patch-kernel\S+|-)", stdout)
+ all_cve_info = re.findall(r"(CVE-\d{4}-\d+)\s+([\w+/.]+)\s+(kernel-\d\S+|-)\s+(patch-kernel-\d\S+|-)", stdout)
if not all_cve_info:
return cve_info_list
@@ -368,7 +368,7 @@ class VulnerabilityManage:
# ("CVE-2021-43976","Important/Sec.", "kernel-4.19.90-2201.1.0.0132.oe1.x86_64"),
# ("CVE-2021-0941","Important/Sec.", "kernel-4.19.90-2201.1.0.0132.oe1.x86_64")
# ]
- fixed_cves_info = re.findall(r"(CVE-\d{4}-\d+)\s+([\w+/.]+)\s+(kernel\S+)", stdout)
+ fixed_cves_info = re.findall(r"(CVE-\d{4}-\d+)\s+([\w+/.]+)\s+(kernel-\d\S+)", stdout)
if not fixed_cves_info:
return fixed_cves
@@ -407,7 +407,7 @@ class VulnerabilityManage:
# ("CVE-2021-xxxx", "Important/Sec.", "-", "patch-redis-6.2.5-1-SGL_CVE_2023_1111_CVE_2023_1112-1-1.x86_64")
# ]
hotpatch_status = self._query_applied_hotpatch_status()
- all_cve_info = re.findall(r"(CVE-\d{4}-\d+)\s+([\w+/.]+)\s+(kernel\S+|-)\s+(patch-kernel\S+|-)", stdout)
+ all_cve_info = re.findall(r"(CVE-\d{4}-\d+)\s+([\w+/.]+)\s+(kernel-\d\S+|-)\s+(patch-kernel-\d\S+|-)", stdout)
cve_info_fixed_by_coldpatch, cve_info_fixed_by_hotpatch, hotpatch_dic = [], [], defaultdict(str)
for cve_id, _, coldpatch, hotpatch in all_cve_info:
@@ -472,7 +472,7 @@ class VulnerabilityManage:
# ("CVE-2023-1112", "redis-6.2.5-1/SGL_CVE_2023_1111_CVE_2023_1112-1-1/redis-server", "NOT-APPLIED"),
# ("CVE-2023-1111", "redis-6.2.5-1/ACC-1-1/redis-benchmark", "ACTIVED")
# ]
- applied_hotpatch_info_list = re.findall(r"(CVE-\d{4}-\d+)\s+(kernel[\w\-/.]+)\s+([A-W]+)", stdout)
+ applied_hotpatch_info_list = re.findall(r"(CVE-\d{4}-\d+)\s+(kernel-\d[\w\-/.]+)\s+([A-W]+)", stdout)
if not applied_hotpatch_info_list:
return result
--
Gitee

167
0002-support-restore-grubby-if-kabi-check-failed.patch Normal file
View File

@ -0,0 +1,167 @@
From 2c3dcc5bb5de4d3f83902bb8cb7f0fe1fa9a55b9 Mon Sep 17 00:00:00 2001
From: wang-guangge <wangguangge@huawei.com>
Date: Tue, 19 Dec 2023 21:03:48 +0800
Subject: [PATCH] support restore default boot kernel if kabi check failed
---
hotpatch/hotupgrade.py | 19 ++++++++-----
hotpatch/upgrade_en.py | 61 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 73 insertions(+), 7 deletions(-)
diff --git a/hotpatch/hotupgrade.py b/hotpatch/hotupgrade.py
index 37497cf..4e1ea96 100644
--- a/hotpatch/hotupgrade.py
+++ b/hotpatch/hotupgrade.py
@@ -43,6 +43,7 @@ class HotupgradeCommand(dnf.cli.Command):
is_need_accept_kernel_hp = False
is_kernel_coldpatch_installed = False
kernel_coldpatch = ''
+ previous_boot_kernel = None
@staticmethod
def set_argparser(parser):
@@ -80,6 +81,9 @@ class HotupgradeCommand(dnf.cli.Command):
commands._checkEnabledRepo(self.base)
def run(self):
+ self.upgrade_en = UpgradeEnhanceCommand(self.cli)
+ self.previous_boot_kernel = self.upgrade_en.get_default_boot_kernel()
+
if self.opts.pkg_specs:
self.hp_list = self.opts.pkg_specs
elif self.opts.cves or self.opts.advisory:
@@ -181,20 +185,21 @@ class HotupgradeCommand(dnf.cli.Command):
Returns:
bool: if hotupgrade task success
"""
- upgrade_en = UpgradeEnhanceCommand(self.cli)
-
is_task_success = True
if self.is_kernel_coldpatch_installed:
if not is_all_kernel_hp_actived:
logger.info(_('Gonna remove %s due to some kernel hotpatch activation failed.'), self.kernel_coldpatch)
- upgrade_en.remove_rpm(str(self.kernel_coldpatch))
+ self.upgrade_en.rebuild_rpm_db()
+ self.upgrade_en.remove_rpm(str(self.kernel_coldpatch))
+ self.upgrade_en.restore_default_boot_kernel(self.previous_boot_kernel)
self.is_need_accept_kernel_hp = False
# process kabi check
- elif not upgrade_en.kabi_check(str(self.kernel_coldpatch)) and not self.opts.force:
+ elif not self.upgrade_en.kabi_check(str(self.kernel_coldpatch)) and not self.opts.force:
logger.info(_('Gonna remove %s due to Kabi check failed.'), self.kernel_coldpatch)
# rebuild rpm database for processing kernel rpm remove operation
- upgrade_en.rebuild_rpm_db()
- upgrade_en.remove_rpm(str(self.kernel_coldpatch))
+ self.upgrade_en.rebuild_rpm_db()
+ self.upgrade_en.remove_rpm(str(self.kernel_coldpatch))
+ self.upgrade_en.restore_default_boot_kernel(self.previous_boot_kernel)
self.is_need_accept_kernel_hp = True
if target_remove_hp:
@@ -203,7 +208,7 @@ class HotupgradeCommand(dnf.cli.Command):
# it indicates that the hotupgrade task failed
is_task_success &= False
for hotpatch in target_remove_hp:
- upgrade_en.remove_rpm(hotpatch)
+ self.upgrade_en.remove_rpm(hotpatch)
return is_task_success
def _apply_hp(self, hp_full_name):
diff --git a/hotpatch/upgrade_en.py b/hotpatch/upgrade_en.py
index 94ba4da..0bd78cc 100644
--- a/hotpatch/upgrade_en.py
+++ b/hotpatch/upgrade_en.py
@@ -12,6 +12,7 @@
# ******************************************************************************/
import gzip
import subprocess
+from typing import Optional
import dnf
from dnf.cli import commands
@@ -36,6 +37,7 @@ def cmd_output(cmd):
@dnf.plugin.register_command
class UpgradeEnhanceCommand(dnf.cli.Command):
SYMVERS_FILE = "/boot/symvers-%s.gz"
+ previous_boot_kernel = None
aliases = ['upgrade-en']
summary = _(
@@ -80,8 +82,65 @@ class UpgradeEnhanceCommand(dnf.cli.Command):
self.skipped_grp_specs = None
def run(self):
+ # if kernel kabi check failed, need change back to the default boot kernel version
+ self.previous_boot_kernel = self.get_default_boot_kernel()
self.upgrade()
+ @staticmethod
+ def get_default_boot_kernel() -> Optional[str]:
+ """
+ Get default boot kernel version.
+
+ Returns:
+ str: default boot kernel
+ """
+ cmd = ["grubby", "--default-kernel"]
+ # 'grubby --default-kernel' shows boot default kernel version in the system
+ # e.g.
+ # [root@openEuler ~]# grubby --default-kernel
+ # /boot/vmlinuz-4.19.90-2112.8.0.0131.oe1.x86_64
+ output, return_code = cmd_output(cmd)
+ default_boot_kernel = output.split('\n')[0]
+ if return_code != SUCCEED:
+ return None
+ return default_boot_kernel
+
+ @staticmethod
+ def restore_default_boot_kernel(target_boot_kernel: str):
+ """
+ Restore default boot kernel version.
+
+ Args:
+ target_boot_kernel(str): target boot kernel
+ """
+ # 'grubby --set-default=/boot/vmlinuz-4.19.90-2112.8.0.0131.oe1.x86_64' can set default boot kernel version
+ # to kernel-4.19.90-2112.8.0.0131.oe1.x86_64
+ if not target_boot_kernel:
+ print("Get default boot kernel before upgrade failed.")
+ return
+
+ cmd = ["grubby", "--set-default=%s" % target_boot_kernel]
+ try:
+ # e.g. 4.19.90-2112.8.0.0131.oe1.x86_64
+ target_boot_kernel_vere = target_boot_kernel.split('-', 1)[1]
+ target_boot_kernel_nevra = "kernel-%s" % target_boot_kernel_vere
+ except IndexError as e:
+ print(
+ "Parse target boot kernel failed. Please check if target boot kernel path is correct: %s."
+ % target_boot_kernel,
+ "\nRestore the default boot kernel failed. Please manually check the default boot kernel to prevent unexpected kernel switching after reboot.",
+ )
+ return
+
+ output, return_code = cmd_output(cmd)
+ if return_code != SUCCEED:
+ print(
+ "Restore the default boot kernel failed: %s. Please manually check the default boot kernel to prevent unexpected kernel switching after reboot."
+ % target_boot_kernel_nevra
+ )
+ return
+ print("Restore the default boot kernel succeed: %s." % target_boot_kernel_nevra)
+
def run_transaction(self):
"""
Process kabi check for kernel rpm package installed this time. If the kernel rpm pakcgae fails kabi check,
@@ -100,6 +159,8 @@ class UpgradeEnhanceCommand(dnf.cli.Command):
# when processing remove operation, do not achieve the expected result of installing related rpm,
# it indicates that the upgrade task failed
self.remove_rpm(kernel_pkg)
+ # change back to the default boot kernel version before upgrade
+ self.restore_default_boot_kernel(self.previous_boot_kernel)
exit(1)
def remove_rpm(self, pkg: str):
--
2.27.0

27
0003-fix-bug-in-test_hotpatch.py.patch
View File

@ -1,27 +0,0 @@
From ccbd7a6dea68303fb7ec6f777f0e6b8d9e6c7773 Mon Sep 17 00:00:00 2001
From: wang-guangge <wangguangge@huawei.com>
Date: Wed, 15 Nov 2023 10:35:42 +0800
Subject: [PATCH] fix bug in test_hotpatch.py
---
hotpatch/test_hotpatch.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hotpatch/test_hotpatch.py b/hotpatch/test_hotpatch.py
index f46faed..e903d55 100644
--- a/hotpatch/test_hotpatch.py
+++ b/hotpatch/test_hotpatch.py
@@ -13,8 +13,8 @@
import unittest
from unittest import mock
-from .hotpatch import HotpatchCommand
-from .syscare import SUCCEED, FAIL
+from .hotpatch_ops import HotpatchCommand
+from .syscare import FAIL, SUCCEED
class HotpatchTestCase(unittest.TestCase):
--
2.27.0

1594
0004-Modify-method-of-mark-invalid-data-and-add-summary.patch
View File

File diff suppressed because it is too large Load Diff

82
0005-add-specific-error-information.patch
View File

@ -1,82 +0,0 @@
From 5b0551698b60ea0c01ad9ee223f7009f230caa12 Mon Sep 17 00:00:00 2001
From: wang-guangge <wangguangge@huawei.com>
Date: Mon, 20 Nov 2023 20:51:57 +0800
Subject: [PATCH] add specific error information
---
hotpatch/hotupgrade.py | 9 ++++++---
hotpatch/upgrade_en.py | 8 +++++---
2 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/hotpatch/hotupgrade.py b/hotpatch/hotupgrade.py
index c508e07..5dfee0d 100644
--- a/hotpatch/hotupgrade.py
+++ b/hotpatch/hotupgrade.py
@@ -12,17 +12,19 @@
# ******************************************************************************/
from __future__ import print_function
+from time import sleep
+
import dnf.base
import dnf.exceptions
import hawkey
-from time import sleep
from dnf.cli import commands
from dnf.cli.option_parser import OptionParser
from dnfpluginscore import _, logger
-from .upgrade_en import UpgradeEnhanceCommand
+
from .hot_updateinfo import HotUpdateinfoCommand
-from .updateinfo_parse import HotpatchUpdateInfo
from .syscare import Syscare
+from .updateinfo_parse import HotpatchUpdateInfo
+from .upgrade_en import UpgradeEnhanceCommand
from .version import Versions
EMPTY_TAG = "-"
@@ -184,6 +186,7 @@ class HotupgradeCommand(dnf.cli.Command):
output, status = self.syscare.apply(hp_subname)
if status:
logger.info(_('Apply hot patch failed: %s.'), hp_subname)
+ logger.info(_('%s'), output)
else:
logger.info(_('Apply hot patch succeed: %s.'), hp_subname)
return status
diff --git a/hotpatch/upgrade_en.py b/hotpatch/upgrade_en.py
index 266bcae..3053179 100644
--- a/hotpatch/upgrade_en.py
+++ b/hotpatch/upgrade_en.py
@@ -10,13 +10,14 @@
# PURPOSE.
# See the Mulan PSL v2 for more details.
# ******************************************************************************/
-import dnf
import gzip
import subprocess
-from dnfpluginscore import _
+
+import dnf
from dnf.cli import commands
from dnf.cli.commands.upgrade import UpgradeCommand
from dnf.cli.option_parser import OptionParser
+from dnfpluginscore import _, logger
SUCCEED = 0
FAIL = 255
@@ -111,10 +112,11 @@ class UpgradeEnhanceCommand(dnf.cli.Command):
output, return_code = cmd_output(remove_cmd)
if return_code != SUCCEED:
print('Remove package failed: %s.' % pkg)
+ print(output)
exit(1)
else:
print('Remove package succeed: %s.' % pkg)
- # do not achieve the expected result of installing related kernel rpm
+ # do not achieve the expected result of installing related rpm
exit(1)
def rebuild_rpm_db(self):
--
2.27.0

63
0006-update-return-log-field-of-the-cve-fix-func.patch
View File

@ -1,63 +0,0 @@
From 27df2fbb6c18c382e7099015915f7efb673a9e06 Mon Sep 17 00:00:00 2001
From: rabbitali <wenxin32@foxmail.com>
Date: Tue, 21 Nov 2023 09:02:09 +0800
Subject: [PATCH] update return log field of the cve fix func
---
ceres/manages/vulnerability_manage.py | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/ceres/manages/vulnerability_manage.py b/ceres/manages/vulnerability_manage.py
index da98297..23ae2ce 100644
--- a/ceres/manages/vulnerability_manage.py
+++ b/ceres/manages/vulnerability_manage.py
@@ -621,11 +621,12 @@ class VulnerabilityManage:
a tuple containing two elements (update result, log).
"""
code, stdout, stderr = execute_shell_command(f"dnf upgrade-en {rpm_name} -y")
+ log = stdout + stderr
if code != CommandExitCode.SUCCEED:
- return TaskExecuteRes.FAIL, stderr
- if "Complete" not in stdout:
- return TaskExecuteRes.FAIL, stdout
- return TaskExecuteRes.SUCCEED, stdout
+ return TaskExecuteRes.FAIL, log
+ if "Complete" not in log:
+ return TaskExecuteRes.FAIL, log
+ return TaskExecuteRes.SUCCEED, log
def _update_hotpatch_by_dnf_plugin(self, hotpatch_pkg: str) -> Tuple[str, str]:
"""
@@ -645,22 +646,23 @@ class VulnerabilityManage:
update_command = f"dnf hotupgrade {hotpatch_pkg} -y"
code, stdout, stderr = execute_shell_command(update_command)
+ log = stdout + stderr
if code != CommandExitCode.SUCCEED:
- return TaskExecuteRes.FAIL, stderr
+ return TaskExecuteRes.FAIL, log
if "Apply hot patch succeed" not in stdout and "No hot patches marked for install" not in stdout:
- return TaskExecuteRes.FAIL, stdout
+ return TaskExecuteRes.FAIL, log
if not self.takeover and self.accepted:
try:
hotpatch_name = hotpatch_pkg.rsplit(".", 1)[0].split("-", 1)[1]
- _, log = self._set_hotpatch_status_by_dnf_plugin(hotpatch_name, "accept")
- stdout += f"\n\n{log}"
+ _, hotpatch_status_set_log = self._set_hotpatch_status_by_dnf_plugin(hotpatch_name, "accept")
+ log += f"\n\n{hotpatch_status_set_log}"
except IndexError as error:
LOGGER.error(error)
- stdout += f"\n\nhotpatch status set failed due to can't get correct hotpatch name!"
+ log += f"\n\nhotpatch status set failed due to can't get correct hotpatch name!"
- return TaskExecuteRes.SUCCEED, stdout
+ return TaskExecuteRes.SUCCEED, log
@staticmethod
def _set_hotpatch_status_by_dnf_plugin(hotpatch: str, operation: str) -> Tuple[bool, str]:
--
2.33.0

BIN
aops-ceres-v1.3.4.tar.gz
View File

Binary file not shown.

BIN
aops-ceres-v1.4.1.tar.gz Normal file
View File

Binary file not shown.

58
aops-ceres.spec
View File

@ -1,25 +1,20 @@
%define datool_with_testing 0
Name: aops-ceres
Version: v1.3.4
Release: 8
Version: v1.4.1
Release: 3
Summary: An agent which needs to be adopted in client, it managers some plugins, such as gala-gopher(kpi collection), fluentd(log collection) and so on.
License: MulanPSL2
URL: https://gitee.com/openeuler/%{name}
Source0: %{name}-%{version}.tar.gz
Patch0001: 0001-support-kabi-check.patch
Patch0002: 0002-modify-re-of-kernel-filter.patch
Patch0003: 0003-fix-bug-in-test_hotpatch.py.patch
Patch0004: 0004-Modify-method-of-mark-invalid-data-and-add-summary.patch
Patch0005: 0005-add-specific-error-information.patch
Patch0006: 0006-update-return-log-field-of-the-cve-fix-func.patch
BuildRequires: python3-setuptools
Requires: python3-requests python3-jsonschema python3-libconf
Requires: python3-concurrent-log-handler dmidecode dnf-hotpatch-plugin >= v1.3.4
Provides: aops-ceres
Conflicts: aops-agent
Patch0001: 0001-improve-status-judgement-and-hotupgrade-logic.patch
Patch0002: 0002-support-restore-grubby-if-kabi-check-failed.patch
%description
An agent which needs to be adopted in client, it managers some plugins, such as gala-gopher(kpi collection), fluentd(log collection) and so on.
@ -70,9 +65,9 @@ cp -r hotpatch %{buildroot}/%{python3_sitelib}/dnf-plugins/
# install for da-tool
mkdir -p ${RPM_BUILD_ROOT}%{_bindir}
mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}
install -b -m640 ./extra-tools/da-tool/conf/da-tool.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/
install -b -m755 ./extra-tools/da-tool/build/da-tool-analysis ${RPM_BUILD_ROOT}%{_bindir}/
install -b -m755 ./extra-tools/da-tool/script/da-tool.sh ${RPM_BUILD_ROOT}%{_bindir}/
install -b -m400 ./extra-tools/da-tool/conf/da-tool.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/
install -b -m500 ./extra-tools/da-tool/build/da-tool-analysis ${RPM_BUILD_ROOT}%{_bindir}/
install -b -m500 ./extra-tools/da-tool/script/da-tool.sh ${RPM_BUILD_ROOT}%{_bindir}/
%files
%doc README.*
@ -88,10 +83,45 @@ install -b -m755 ./extra-tools/da-tool/script/da-tool.sh ${RPM_BUILD_ROOT}
%files -n da-tool
%defattr (-, root, root)
%config(noreplace) %{_sysconfdir}/da-tool.conf
%attr(755, root, root) %{_bindir}/da-tool.sh
%attr(755, root, root) %{_bindir}/da-tool-analysis
%attr(0500, root, root) %{_bindir}/da-tool.sh
%attr(0500, root, root) %{_bindir}/da-tool-analysis
%changelog
* Wed Dec 20 2023 wangguangge<wangguangge@huawei.com> - v1.4.1-3
- support restore default grubby boot kernel if kernel kabi check failed
* Mon Dec 18 2023 wangguangge<wangguangge@huawei.com> - v1.4.1-2
- improve task execution status code and hotupgrade logic of reinstalling active/accept hotpatch
* Mon Dec 18 2023 wangguangge<wangguangge@huawei.com> - v1.4.1-1
- update to v1.4.1
- update cve fix logic
- support rollback operation for kernel hotpatch/coldpatch
* Tue Dec 12 2023 wenxin<wenxin32@foxmail.com> - v1.4.0-2
- fix unboundlocalerror with variable name log
* Tue Dec 12 2023 wenxin<wenxin32@foxmail.com> - v1.4.0-1
- Change CVE rollback task to hotpatch remove
- update cve scan method and cve fix method
* Mon Dec 4 2023 liuchanggeng<liuchanggeng@huawei.com> - v1.3.4-12
- to maintain functional stability, da-tool only releases network related analysis
- it is not allowed to modify the configuration file of the da-tool
* Tue Nov 28 2023 liuchanggeng<liuchanggeng@huawei.com> - v1.3.4-11
- da-tool consider trace as valid data when first core lost scheduling information
- update document
* Mon Nov 27 2023 liuchanggeng<liuchanggeng@huawei.com> - v1.3.4-10
- add check of command parameters and configuration files
- handling scenarios with lost scheduling information
- update document
* Thu Nov 23 2023 liuchanggeng<liuchanggeng@huawei.com> - v1.3.4-9
- da-tool add usage
- da-tool check for duplicate configurations
* Tue Nov 21 2023 wenxin<wenxin32@foxmail.com> - v1.3.4-8
- update return log field of the cve fix func
- add specific error information